# Cross-domain AJAX Authentication

## Intended Use:

JSON endpoints available on the Loyalty Portal portal built by HEBS Digital exist in order to authenticate and fetch profile details for an active session. The intended use of the endpoints is to be consumed by 3rd party in order to facilitate:

1. Logging-in *from* `hotelwebsite.com`
2. Fetching basic profile metadata (first name, last name, point

   balance, etc.) for logged-in users

## Endpoints

### Authentication

1. **URI**: `/.../authenticate` *(i.e.* [*https://www.hotelwebsite.com/loyalty/authenticate*](https://www.hotelwebsite.com/loyalty/authenticate)*)*
2. **Description**: Used for authenticating against the CRM profile. Under the hood, a call to validate the credentials is made against the underlying CRM.
3. **Request Type**: POST / AJAX (request header “X-Requested-With” set to “XMLHttpRequest”). The hostname of the origin environment (i.e. domain.com) must be whitelisted by Cendyn IT in order for CORS to work correctly.
4. **Form Data / Parameters:**
   1. `username` – the member ID used to authenticate against the CRM (i.e. LoginID)&#x20;
   2. `password` – the member password
   3. `task` – must equal “login”
5. **Example Response:**

```javascript
{
  "code": 200,
  "status": true,
  "message": "Successfully authenticated",
  "data": {
    "firstname": "User",
    "lastname": "Lastname",
    "profileid": "ABC123",
    "loginid": "test@hebsdigital.com",
    "username": "test@hebsdig ital.com",
    "membernumber": "123456789",
    "membertier": "Base Level",
    "balance": 0
  }
}
```

### Fetch User Details

1. **URI**: `/.../authenticate` *(i.e.* [*https://www.hotelwebsite.com/loyalty/authenticate*](https://www.hotelwebsite.com/loyalty/authenticate)*)*
2. **Description**: Used for checking if a session is established on the loyalty portal. If a session is established, the profile will be returned as JSON.
3. **Request Type**: POST / AJAX (request header “X-Requested-With” set to

   “XMLHttpRequest”). For cross domain, a JSONP request should be used

   by performing a GET request with a query-string parameter “callback”
4. **Form Data / Parameters:**
   1. `task` – must equal “authenticate”

```javascript
{
  "data": {
    "firstname": "User",
    "lastname": "Lastname",
    "profileid": "ABC123",
    "loginid": "test@hebsdigital.com",
    "username": "test@hebsdigital.com",
    "membernumber": "123456789",
    "membertier": "Base Level",
    "balance": 0,
    "rememberme": "0",
    "lifetimeex piry": 636755959760000000,
    "sessionexpiry": 636755959760000000
  },
  "status": true
}
```
