Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So I'm trying to create and secure a mobile REST API on an existing server that runs our web app. We're not going to open the API to the public and we will be writing the client app using PhoneGap/Javascript/HTML. We could very well use HTTP Basic but I wanted something a little more advanced and secure. I do not want to use OAuth or Amazon's AWS security as those seem to be mainly for opening up your API to the public or a 3rd party.

I'm really new to REST APIs and security, but after doing some research I plan to use this implementation as written by Google. I'll sum up the general idea:

  • User sends the server credentials through a secure POST
  • If the credentials match. The server creates a token, saves it in the database, then sends it back to the user. The token will be based on the user's UUID and a timestamp.
  • The database will store the last time the user changed their password and will only validate calls with tokens that were issued after that time.
  • The user then sends this token in the header with each API call

How secure is this implementation? How do I stop brute force attacks on my authentication method? Any other suggestions or recommendations are appreciated.

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

The security of this solution depends on the security of two elements:

  • The connection: If you're using SSL then the problems linked to connection security are well understood (if not always easy to evaluate): client-side root store quality, proper key exchange, use of secure protocols, etc.

  • The token itself. First, it needs to be generated in a way that makes it difficult to guess and impossible to reuse. It also needs to be protected while on the client system (this is more of a problem in a web application than on a dedicated client but needs to be mentionned).

Assuming that both aspects of the problem are properly handled, then yes, such an implementation is pretty secure.

share|improve this answer
    
So how do you keep the token secure on a mobile phone? Is local storage good enough? –  TheDrizzle Nov 12 '13 at 21:10
    
That's a rather different question and the answer will depend on what mobile platform you're talking about, how long you want to keep the token around, what you want to protect it against and probably the value of what you're protecting. –  Stephane Nov 13 '13 at 8:21
    
Well I'll be using PhoneGap so it would just be the local storage API. I want to protect it against someone besides the user of the app getting access to it. The value of the data is not super critical, but as an exercise I want to make this secure as possible. –  TheDrizzle Nov 14 '13 at 8:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.