Best Practice with accessing API Server on mobile app which login using OAuth












0















I have the following entities:




  • An mobile app

  • in-house API Server

  • in-house OAuth Server


I need to implement OAuth in mobile app to the OAuth Server, and access user information in the API server afterward, and I am having trouble with how this can be achieved securely. I have only think of the following methods:



Method 1: Pass user id directly from Mobile App to API server




  1. Login user through OAuth in mobile app (using library like AppAuth)

  2. Store the user id retrived from OAuth in mobile app

  3. Mobile app send the user id to the API server, so they can retrive the correct resources back to the mobile app


However, this method seems non-secure, as attacker can fake their user id when passing to the API.



Method 2: Pass OAuth access_token to API server, let API server call OAuth server again




  1. Login user through OAuth in mobile app (using library like AppAuth)

  2. Store the access_token retrived from OAuth

  3. Mobile app send the access_token to the API server

  4. API server pass the access_token to the OAuth server

  5. OAuth server return the user info back to API server

  6. Now API server have the user info, and can return the correct resources back to the mobile app
    enter image description here
    Method 2 seems more secure, however I don't seems to see this kind of infrastructure suggested by anybody. This method also seems resource intensive as API server need to call OAuth server every time an API is called.


So my question is:




  1. What is the best Practice with accessing API Server on mobile app which login using OAuth?

  2. If there is a best practice, any link to those resources?


Thank you!






mobile oauth-2.0 api-design







share|improve this question





























    0















    I have the following entities:




    • An mobile app

    • in-house API Server

    • in-house OAuth Server


    I need to implement OAuth in mobile app to the OAuth Server, and access user information in the API server afterward, and I am having trouble with how this can be achieved securely. I have only think of the following methods:



    Method 1: Pass user id directly from Mobile App to API server




    1. Login user through OAuth in mobile app (using library like AppAuth)

    2. Store the user id retrived from OAuth in mobile app

    3. Mobile app send the user id to the API server, so they can retrive the correct resources back to the mobile app


    However, this method seems non-secure, as attacker can fake their user id when passing to the API.



    Method 2: Pass OAuth access_token to API server, let API server call OAuth server again




    1. Login user through OAuth in mobile app (using library like AppAuth)

    2. Store the access_token retrived from OAuth

    3. Mobile app send the access_token to the API server

    4. API server pass the access_token to the OAuth server

    5. OAuth server return the user info back to API server

    6. Now API server have the user info, and can return the correct resources back to the mobile app
      enter image description here
      Method 2 seems more secure, however I don't seems to see this kind of infrastructure suggested by anybody. This method also seems resource intensive as API server need to call OAuth server every time an API is called.


    So my question is:




    1. What is the best Practice with accessing API Server on mobile app which login using OAuth?

    2. If there is a best practice, any link to those resources?


    Thank you!






    mobile oauth-2.0 api-design







    share|improve this question



























      0












      0








      0








      I have the following entities:




      • An mobile app

      • in-house API Server

      • in-house OAuth Server


      I need to implement OAuth in mobile app to the OAuth Server, and access user information in the API server afterward, and I am having trouble with how this can be achieved securely. I have only think of the following methods:



      Method 1: Pass user id directly from Mobile App to API server




      1. Login user through OAuth in mobile app (using library like AppAuth)

      2. Store the user id retrived from OAuth in mobile app

      3. Mobile app send the user id to the API server, so they can retrive the correct resources back to the mobile app


      However, this method seems non-secure, as attacker can fake their user id when passing to the API.



      Method 2: Pass OAuth access_token to API server, let API server call OAuth server again




      1. Login user through OAuth in mobile app (using library like AppAuth)

      2. Store the access_token retrived from OAuth

      3. Mobile app send the access_token to the API server

      4. API server pass the access_token to the OAuth server

      5. OAuth server return the user info back to API server

      6. Now API server have the user info, and can return the correct resources back to the mobile app
        enter image description here
        Method 2 seems more secure, however I don't seems to see this kind of infrastructure suggested by anybody. This method also seems resource intensive as API server need to call OAuth server every time an API is called.


      So my question is:




      1. What is the best Practice with accessing API Server on mobile app which login using OAuth?

      2. If there is a best practice, any link to those resources?


      Thank you!






      mobile oauth-2.0 api-design







      share|improve this question
















      I have the following entities:




      • An mobile app

      • in-house API Server

      • in-house OAuth Server


      I need to implement OAuth in mobile app to the OAuth Server, and access user information in the API server afterward, and I am having trouble with how this can be achieved securely. I have only think of the following methods:



      Method 1: Pass user id directly from Mobile App to API server




      1. Login user through OAuth in mobile app (using library like AppAuth)

      2. Store the user id retrived from OAuth in mobile app

      3. Mobile app send the user id to the API server, so they can retrive the correct resources back to the mobile app


      However, this method seems non-secure, as attacker can fake their user id when passing to the API.



      Method 2: Pass OAuth access_token to API server, let API server call OAuth server again




      1. Login user through OAuth in mobile app (using library like AppAuth)

      2. Store the access_token retrived from OAuth

      3. Mobile app send the access_token to the API server

      4. API server pass the access_token to the OAuth server

      5. OAuth server return the user info back to API server

      6. Now API server have the user info, and can return the correct resources back to the mobile app
        enter image description here
        Method 2 seems more secure, however I don't seems to see this kind of infrastructure suggested by anybody. This method also seems resource intensive as API server need to call OAuth server every time an API is called.


      So my question is:




      1. What is the best Practice with accessing API Server on mobile app which login using OAuth?

      2. If there is a best practice, any link to those resources?


      Thank you!






      mobile oauth-2.0 api-design




      mobile oauth-2.0 api-design






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Jan 3 at 2:06







      Ng Sek Long

















      asked Jan 2 at 11:21









      Ng Sek LongNg Sek Long

      581417




      581417
























          0






          active

          oldest

          votes











          Your Answer






          StackExchange.ifUsing("editor", function () {
          StackExchange.using("externalEditor", function () {
          StackExchange.using("snippets", function () {
          StackExchange.snippets.init();
          });
          });
          }, "code-snippets");

          StackExchange.ready(function() {
          var channelOptions = {
          tags: "".split(" "),
          id: "1"
          };
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function() {
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled) {
          StackExchange.using("snippets", function() {
          createEditor();
          });
          }
          else {
          createEditor();
          }
          });

          function createEditor() {
          StackExchange.prepareEditor({
          heartbeatType: 'answer',
          autoActivateHeartbeat: false,
          convertImagesToLinks: true,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: 10,
          bindNavPrevention: true,
          postfix: "",
          imageUploader: {
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          },
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          });


          }
          });














          draft saved

          draft discarded


















          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54005413%2fbest-practice-with-accessing-api-server-on-mobile-app-which-login-using-oauth%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown

























          0






          active

          oldest

          votes








          0






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes
















          draft saved

          draft discarded




















































          Thanks for contributing an answer to Stack Overflow!


          • Please be sure to answer the question. Provide details and share your research!

          But avoid …



          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.


          To learn more, see our tips on writing great answers.




          draft saved


          draft discarded














          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54005413%2fbest-practice-with-accessing-api-server-on-mobile-app-which-login-using-oauth%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          Popular posts from this blog

          'app-layout' is not a known element: how to share Component with different Modules

          Image
          0 My application was working fine until I decided to go with lazy loading: So, my shared component looks like this: import { Component, Renderer2 } from '@angular/core'; export interface FormModel { captcha?: string; } @Component({ selector: 'app-layout', templateUrl: './app-layout.component.html', styleUrls: ['./app-layout.css'] }) export class FullLayoutComponent { } app-layout.component.ts I am using this component in my Another component say school-home.component.html like this: <app-layout> </app-layout> and it was working fine until I created a Module school-home.module.ts like this: import { NgModule } from '@angular/core'; import { CommonModule } from '@angular/common'; import { SchoolhomeRoutingModule ...
          Read more

          android studio warns about leanback feature tag usage required on manifest while using Unity exported app?

          Image
          .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box; } 0 This is a simple project showing cubes on Unity, exported to android project and imported on Android studio. On maifest file it showed following warning: Expecting <uses-feature android:name="android.software.leanback" android:required="false" /> tag I have no information about it. And also on default emptyview android project does not use/mention this feature. I know it is required by TV's and such but why its not added by default? Why is this? And Should I concern about it? android unity3d ...
          Read more

          WPF add header to Image with URL pettitions [duplicate]

          Image
          up vote 0 down vote favorite This question already has an answer here: Image source URI requiring authorization 3 answers Add header to all* HTTP requests on a machine 1 answer first of all sorry for my english. Recently I added some security in the backend of my project, and now I need to send a validation code(apiKey) inside the headers to retrieve the images. I have a problem with ALL images in my project that I had attached in my UI. For example, before I had: <Image Height="90" Source="{Binding Video.Thumbnail}"/> Now I need to change my code to create a CUSTOM petition add the apiKey in the header:...
          Read more