Interactive login vs bot login

[AlgoTrader]

I have been thinking which one I like and ... I selected to use both for my Betfair API library.

The algorithm is following. If there are client-2048.key and client-2048.crt files in current app directory, then bot login is used. If they are missing - the library fallback to interactive login tranparently.

The example is:

C:\Projects\Github\betfair\test [master]> node login.js
===== Logging in to Betfair (bot) =====
Login OK, 0.429 secs
===== Logging out... =====
Logout OK, 0 secs
Done

C:\Projects\Github\betfair\test [master]> ren .\client-2048.key .\client-2048-bak.key

C:\Projects\Github\betfair\test [master]> node login.js
===== Logging in to Betfair (interactive) =====
Login OK, 0.377 secs
===== Logging out... =====
Logout OK, 0 secs
Done

C:\Projects\Github\betfair\test [master]> ren .\client-2048-bak.key client-2048.key

C:\Projects\Github\betfair\test [master]> node login.js
===== Logging in to Betfair (bot) =====
Login OK, 0.377 secs
===== Logging out... =====
Logout OK, 0 secs
Done

As usual, I prefer think of interactive and bot login as "strong" and "weak" logins. Interactive login is in fact so easily used in non-interactive way

[austrianChristian]

Anybody an idea if following can work. I want to have one software that runs the interactive login and hands over the session token to other software. My idea is to login interactive save the session token in a database so that my other software(not only on that pc) can hijack it.

Call me lazy but I don't want to setup open-ssl on every computer. Neither do I want to have an interactive login for every software. If that does not work, I must find a way to "trick" the interactive login to work without a webbrowser control.

[AlgoTrader]

Call me lazy but I don't want to setup open-ssl on every computer. Neither do I want to have an interactive login for every software.

1) All the software excluding quite a few things uses OpenSSL. Chrome, Firefox, node.js, python etc have OpenSSL embedded inside.

2) You DO NOT NEED OpenSSL on every computer. You need it to generate .key, .cer, .pem files. You can generate certificate once and use it anywhere.

All you need for bot login to work is .key and .crt files on local filesystem (p12 for C#).

But interactive login just works without certificates, it can be used anywhere.

Both are easy to implement. DB stuff is much more complex then OpenSLL.

[austrianChristian]

I implemented now the interactive login with "hijacking" the session. I have several applications and need to take care of the internet load. Sometimes an internet connection is blocked because of too many requests so I will run an application with the interactive login on a separate line not to lose the session because keepalive request fail.
I thought it will not work with different internet connections because of security reasons. I personally would link the session token not with a user only, I would also link it with the IP-Adress so that it can't be used from another IP-Adress.