I developed a REST API whose clients are mobile apps/websites under my control (API is not open to anyone). Users log into my mobile app/website with their Facebook or g+ login. I'd like to secure the API so that either:
(a) users can access it only after successfully logging into fb/g+ via my app/website
(b) only my apps/websites can access it.
I came up with following for (a) and would appreciate feedback on any weaknesses or improvements:
- All data between mobile app and REST API are encrypted with TLS.
- User logs into my app with their Facebook/g+ credentials.
- App receives token from fb/g+ and retrieves user info.
- App sends user info (username/email/unique id) and token to REST API (e.g., /login).
- REST API uses token and unique id to make a test call to fb/g+ API to ensure token and user info combo are valid.
- REST API issues its own token to app and caches token keyed by unique id.
- App sends unique id and token with every subsequent access to REST API.
- REST API looks up unique id and token in cache. If it exists, API access is granted to that request.
I'd like to do away with step 5, but don't see how else to verify the credentials given to the REST API.
I also thought about using Basic HTTP Authentication and TLS for (b), and this would be fine for a website client, but for mobile apps, it means the password would have to be stored on the mobile app in some form and susceptible to exposure, wouldn't it? From what I gather, securing an API with Basic Auth and TLS is very common and I can see how it can work for websites, but I don't know of a way to achieve (b) for mobile apps without risking exposure of the password.