Mixing
Best Practice with accessing API Server on mobile app which login using OAuth
0
I have the following entities:
- An mobile app
- in-house API Server
- in-house OAuth Server
I need to implement OAuth in mobile app to the OAuth Server, and access user information in the API server afterward, and I am having trouble with how this can be achieved securely. I have only think of the following methods:
Method 1: Pass user id directly from Mobile App to API server
- Login user through OAuth in mobile app (using library like AppAuth)
- Store the user id retrived from OAuth in mobile app
- Mobile app send the user id to the API server, so they can retrive the correct resources back to the mobile app
However, this method seems non-secure, as attacker can fake their user id when passing to the API.
Method 2: Pass OAuth access_token to API server, let API server call OAuth server again
- Login user through OAuth in mobile app (using library like AppAuth)
- Store the access_token retrived from OAuth
- Mobile app send the access_token to the API server
- API server pass the access_token to the OAuth server
- OAuth server return the user info back to API server
- Now API server have the user info, and can return the correct resources back to the mobile app
Method 2 seems more secure, however I don't seems to see this kind of infrastructure suggested by anybody. This method also seems resource intensive as API server need to call OAuth server every time an API is called.
So my question is:
- What is the best Practice with accessing API Server on mobile app which login using OAuth?
- If there is a best practice, any link to those resources?
Thank you!
mobile oauth-2.0 api-design
asked Jan 2 at 11:21
Ng Sek LongNg Sek Long
581417
add a comment |
0
I have the following entities:
- An mobile app
- in-house API Server
- in-house OAuth Server
I need to implement OAuth in mobile app to the OAuth Server, and access user information in the API server afterward, and I am having trouble with how this can be achieved securely. I have only think of the following methods:
Method 1: Pass user id directly from Mobile App to API server
- Login user through OAuth in mobile app (using library like AppAuth)
- Store the user id retrived from OAuth in mobile app
- Mobile app send the user id to the API server, so they can retrive the correct resources back to the mobile app
However, this method seems non-secure, as attacker can fake their user id when passing to the API.
Method 2: Pass OAuth access_token to API server, let API server call OAuth server again
- Login user through OAuth in mobile app (using library like AppAuth)
- Store the access_token retrived from OAuth
- Mobile app send the access_token to the API server
- API server pass the access_token to the OAuth server
- OAuth server return the user info back to API server
- Now API server have the user info, and can return the correct resources back to the mobile app
Method 2 seems more secure, however I don't seems to see this kind of infrastructure suggested by anybody. This method also seems resource intensive as API server need to call OAuth server every time an API is called.
So my question is:
- What is the best Practice with accessing API Server on mobile app which login using OAuth?
- If there is a best practice, any link to those resources?
Thank you!
mobile oauth-2.0 api-design
asked Jan 2 at 11:21
Ng Sek LongNg Sek Long
581417
add a comment |
0
0
0
I have the following entities:
- An mobile app
- in-house API Server
- in-house OAuth Server
I need to implement OAuth in mobile app to the OAuth Server, and access user information in the API server afterward, and I am having trouble with how this can be achieved securely. I have only think of the following methods:
Method 1: Pass user id directly from Mobile App to API server
- Login user through OAuth in mobile app (using library like AppAuth)
- Store the user id retrived from OAuth in mobile app
- Mobile app send the user id to the API server, so they can retrive the correct resources back to the mobile app
However, this method seems non-secure, as attacker can fake their user id when passing to the API.
Method 2: Pass OAuth access_token to API server, let API server call OAuth server again
- Login user through OAuth in mobile app (using library like AppAuth)
- Store the access_token retrived from OAuth
- Mobile app send the access_token to the API server
- API server pass the access_token to the OAuth server
- OAuth server return the user info back to API server
- Now API server have the user info, and can return the correct resources back to the mobile app
Method 2 seems more secure, however I don't seems to see this kind of infrastructure suggested by anybody. This method also seems resource intensive as API server need to call OAuth server every time an API is called.
So my question is:
- What is the best Practice with accessing API Server on mobile app which login using OAuth?
- If there is a best practice, any link to those resources?
Thank you!
mobile oauth-2.0 api-design
asked Jan 2 at 11:21
Ng Sek LongNg Sek Long
581417
I have the following entities:
- An mobile app
- in-house API Server
- in-house OAuth Server
I need to implement OAuth in mobile app to the OAuth Server, and access user information in the API server afterward, and I am having trouble with how this can be achieved securely. I have only think of the following methods:
Method 1: Pass user id directly from Mobile App to API server
- Login user through OAuth in mobile app (using library like AppAuth)
- Store the user id retrived from OAuth in mobile app
- Mobile app send the user id to the API server, so they can retrive the correct resources back to the mobile app
However, this method seems non-secure, as attacker can fake their user id when passing to the API.
Method 2: Pass OAuth access_token to API server, let API server call OAuth server again
- Login user through OAuth in mobile app (using library like AppAuth)
- Store the access_token retrived from OAuth
- Mobile app send the access_token to the API server
- API server pass the access_token to the OAuth server
- OAuth server return the user info back to API server
- Now API server have the user info, and can return the correct resources back to the mobile app
Method 2 seems more secure, however I don't seems to see this kind of infrastructure suggested by anybody. This method also seems resource intensive as API server need to call OAuth server every time an API is called.
So my question is:
- What is the best Practice with accessing API Server on mobile app which login using OAuth?
- If there is a best practice, any link to those resources?
Thank you!
mobile oauth-2.0 api-design
mobile oauth-2.0 api-design
asked Jan 2 at 11:21
Ng Sek LongNg Sek Long
581417
asked Jan 2 at 11:21
Ng Sek LongNg Sek Long
581417
edited Jan 3 at 2:06
Ng Sek Long
asked Jan 2 at 11:21
Ng Sek LongNg Sek Long
581417
asked Jan 2 at 11:21
Ng Sek LongNg Sek Long
581417
asked Jan 2 at 11:21
Ng Sek LongNg Sek Long
581417
581417
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54005413%2fbest-practice-with-accessing-api-server-on-mobile-app-which-login-using-oauth%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54005413%2fbest-practice-with-accessing-api-server-on-mobile-app-which-login-using-oauth%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
