I've dealt with OAuth before but I'm not too sure about the API I'm working with now. My question is basically, is this woefully insecure?
As I understand it, oAuth does the following (roughly):
Service X gives me a key and a secret
I ask the user to grant me access to service X
I send my key and secret to Service X to check. Service X gives me a request token, which I send over with the user.
User confirms they want to let me in, and the service sends them back to me with a token I can keep in my database, and use to make service API calls on their behalf
At some point the token expires, but the service knows who I am, so I can just ask them for a new one
However, the API I'm dealing with works like this (all over https, obv):
They give me an API key.
The user gives me their username and password
I transmit them to the service along with my API key, then discard them
They service sends me back a token I can use to make API calls on their behalf (using the token and my API key), which I store in my database.
At some point, the token expires and I need to get a new one so the user must re-authenticate.
Am I right in thinking that the main weaknesses of this scheme compared to OAuth are as follows?
- there is no guarantee that the request comes from my server, so if anyone broke into my db, they could make API calls at will for all my users, using my API key, which they could get from analysing the POST I have to send when authenticating a given user
- I have to go on reauthenticating the user with a password etc because it's basically just dangerous to have such data floating around
- I'm obliged to provide an HTTPS connection for the user to type in their service password in the first place
It's not life-or-death stuff - it's not people's bank accounts etc - but it would be nice to be reasonably confident there won't be an Exxon Valdez dataspill.
Thank you for any help or advice.