One time use token Mobile / Desktop linking. How to?

Question

I want to know if there's a way or known way to implement this:

Lets say I have:

• a C# WinForms program
• a Javascript Mobile Application (Android / iOS)

What I want to do is:

1. for my C# application to show a one-time use (disposable) code or token.
2. The user enters the code or token in the mobile app
3. The code is no longer available for use and the c# application and mobile application are linked for file exchange (.jpg, .docx, etc)
4. Once the session between the two ended, a new code or token is generated.

Is there any existing approach for this? If not, how would be the best way to implement this?

Answer 1

The way I would do this is as follows:

1. Generate a random string with a function like this one.

2. Store this token, along with the expiry time, user id (if applicable) and the time/date created. I'd suggest creating an object/class for this and only keeping it in a temporary place (so it's not persisted when you close your program).

3. Once inputted on your app, send this code to the Winforms machine from your app using a socket listener like this one.

4. When the Winforms machine receives the code, it verifies if it's correct then if it's still valid. If valid, let the app connect with the app.

5. When done, you need to delete the stored code after an attempt has found it valid or invalid. If the code is valid it doesn't need to be used again and if it's invalid (time expired, wrong user etc.) it should be deleted to avoid misuse.

Answer 2

You could base the code on the logged in user and a timestamp, to verify it you simply regenerate it server-side and verify if it matches.

I believe this approach is common among existing two-factor auths