Usage

This section will teach you how to start using Citrine and how it functions.

2.1 Quick Start

Use the following Javascript code to start using Citrine:

Example 1
https://cdn.kiy.li/code/citrine/citrine-v1-quickstart

This piece of code will result in this page, if you change [DESTINATION] to your desired destination URL (url encoded).

Example 2

You can also hide the login-locked content until the user is logged in, like this. You can find the code for this example here.

Example 3

If you have a seperate login page which then redirects to the content of your site, you can also hide everything on your restricted pages, instead excluding the button contrary to the example above. On your login page, you can simply give the restricted page URL as parameter to Citrine. If the user tries to access the restricted page without being logged in, they can be redirected to your login page.

This can be seen in this example. Nothing special happens if you access this example's main page without being logged in, as it is just the unrestricted login page. After logging in, you will be sent to dashboard.php. Accessing this page without being logged in will send you back to the login page, without showing any restricted content. If you access the login page while being logged in, it will quickly send you to dashboard.php.

Code for login page | Code for dashboard.php (.php can be changed to .html, as no php is used).

Example 4

You can also give your login page as URL parameter, and process the login on your own page after Citrine login.

Example | Code for login page | Code for dashboard.php

This redirects you back to the login page after logging in, which then sees you are logged in, and sends you to dashboard.php. This allows is to do additional processing after login. In this example, we console log 'User is logged in!'.

Scripts

If you want just the functionality and not any example content:

https://cdn.kiy.li/code/citrine/citrine-v1-functional.js

Lastly, if you want just the script contents:

https://cdn.kiy.li/code/citrine/citrine-v1-script.js

Please note that you cannot simply use this URL in a script tag's SRC, since you will need to modify [DESTINATION] according to your needs.

It is also important to place the script at the bottom of your page (to make sure it can find your HTML elements).

2.2 Login

Log in using Citrine

You can use this prebuilt 'Log in using Citrine' button, or you can create your own button.

  (Code)

If Citrine is your only login method, you can also just redirect users to https://kiyantk.nl/dev/citrine/?url=[DESTINATION].

Replace [DESTINATION] with your desired destination URL (url encoded).

2.3 Account

To use Citrine, you will need to define the username which the user is logged in with. You can do this using the code below:

2.4 Status

... WIP ...

2.5 Logout

... WIP ...

Endpoints

Citrine has endpoints which provide information or do something in relation to an account.

3.1 /status

The status endpoint is used to get the current login status of an account. This endpoint is used to check if a user in logged in.

https://kiyantk.nl/dev/citrine/status?user=[USERNAME]

The status endpoint can return:

Response value Definition
true The account is logged in
false The account is not logged in
null The account does not exist
notfound The account does not exist

3.2 /logout

The logout endpoint is used to log a given account out.

https://kiyantk.nl/dev/citrine/logout/?user=[USERNAME]

The logout endpoint can return:

Response value Definition
success The account was succesfully logged out
failed The account failed to log out
notfound The account does not exist
noparam No username was given

3.3 /account

The account endpoint is used to get the current logged in account. This endpoint is used to check which user in logged in.

https://kiyantk.nl/dev/citrine/account

The account endpoint can return:

Response value Definition
[USERNAME] This is the account you are currently logged in with
There is no account logged in

Vulnerabilities / Issues

4.1 PHP

If your restricted page contains any PHP that runs when the page is accessed, this will still be executed, since PHP executes before any Javascript is executed. And since Citrine is written in Javascript, PHP will always run before Citrine kicks in.

4.2 Lost credentials

Citrine does not register your email address. Because of this, it is not possible to reset your login credentials.

Data

5.1 Account storage

Citrine does not offer any account-specific data storage. You will need to create your own data storage for accounts.

Citrine only services login processing and login support. Using the currently logged in username you get access to by using Citrine, you can make a system to look up the data for that username.