1

I have a very specific use case. We are working on a Project where user can buy the tickets to an event. In this, we are asking the user to enter an Email id where he can receive the email from where he can receive the ticket onto our App. This email has the link using which user will receive the ticket inside an App. When the user clicks on the link in this email he is redirected to a webpage which checks whether our App is installed on the device, and if it is, he is redirected to the App where he can receive the ticket into his account. If the app is not installed then he is redirected to App store and is asked to install the App. After installing the App the user logs in to our App, now he has to go back to the email, click on the link again in-order receive the ticket inside App. User can use different Email Ids to log in to the App and to receive the email containing the url to receive the ticket. This is a specification which our client wants. Now coming to the problem. We are planning to make this process smooth so that if user clicked on URL to receive the ticket into his account before the App was installed, when he installs the app this should happen automatically. There a multiple problems when trying to implement this:-

1.) There is no way for me to know if a user is to be redirected to a specific screen on the App once he logs in as email id where the email with ticket reception link was sent can be different from the one he logged in.

2.) I was planning to use a combination of IP, Screen Siz and Os Version to make a unique key at the backend side. When user clicks on receive ticket link and is directed to a webpage, I will send this data to Server and store it. When App opens I can again send the data to verify if this user tried to receive Ticket when App was not installed. But in this case, there will be a lot of issues. People using the same kind of device and accessing the internet using same Wifi router will have the same info.

I am not able to think of any solution on how I can uniquely identify the user. There is no way to interchage data between App and Browser cache, neither is it possible for me to access MAC address or Device IMEI from JavaScript. This is to be done for both Android and iOS app.

Any help would be highly appreciated.

5
  • Plain old cookies? Commented Nov 14, 2018 at 6:33
  • App would not be able to access the cookies. The inability to interchange data between a browser and app is the crux of the problem.
    – abhinav
    Commented Nov 15, 2018 at 7:21
  • I want to make sure I understand this because the ramifications are that a user who gains access to one of these links by any means can collect the ticket. It doesn't have to be the same user that purchased the ticket. Are you really sure you want that big of a security hole in your system?
    – Daniel T.
    Commented Jul 31, 2021 at 17:50
  • This is a common problem and is solved with deferred deep linking
    – John Wu
    Commented Aug 30, 2021 at 19:14
  • @DanielT. this is not that unusual a pattern. There are plenty of cases where an email is a ticket (attached PDF or QR code)
    – pjc50
    Commented Apr 28, 2022 at 8:48

2 Answers 2

1

User can use different Email Ids to log in to the App and to receive the email containing the url to receive the ticket.

This is a huge security hole. Emails are not secure and anybody who gains access to that link could get the ticket even if they didn't purchase it. If you really want to do this though maybe something like the below would work:

  1. user clicks on email link.
  2. user is directed to a web page where they have to log in.
  3. once they are logged in: If user has app installed, redirect to the app. If user doesn't have app installed, redirect to App Store.

Since the user logged in on the website, you know which user is going to be collecting the ticket.

0

I'm not completely sure if you need to create user "fingerprint" also natively from the App, but I once worked in one project where we had to recognize returning anonymous clients. We used Fingerprintjs2 to identify clients: https://github.com/Valve/fingerprintjs2

We didn't have many different clients, so I don't know how this scales up to hundreds or thousands of users. You can define multiple properties to utilize in identify process to avoid fingerprint collisions.

3
  • But how will I have access to this fingerprint once the user logs in to the App. I have to redirect the user to a specific screen where he can see the ticket he was trying to receive when he wasn't having the app installed.
    – abhinav
    Commented Oct 12, 2018 at 11:56
  • If you can create similar fingerprints in the web site and in the App, you can store fingerprint to server when user buys the tickets. After user logs in to the App, you can generate new fingerprint within the App and check from the server if it has already similar fingerprint. If fingerprint match is found, you could connect them and forward user to correct tickets. Can you make it work like this? After the match user's account is linked to the tickets, so the stored fingerprints can be safely removed. This way you could decrease possibility of fingerprint collision. Commented Oct 12, 2018 at 12:22
  • That's where I require the help. I am not able to make a similar unique fingerprint on the website as well as app. Using a combo of IP, screen size, os version, device model etc etc but none of these help in creating a unique identifier.
    – abhinav
    Commented Oct 15, 2018 at 5:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.