Tag Info

New answers tagged

1

If you don't intend to perform client authentication via SASL or the like, a certificate is needed only for the server. Just embed the public key you generated in the app and use it for certificate pinning. If get your certificate signed by a CA in Android trust store, you can use Android TLS utilities without any extra step, since the verification will be ...


1

There are two ways you can save authentication information in the browser: Cookies HTML5 Web Storage In each case, you have to trust that browsers are implemented correctly, and that Website A can't somehow access the authentication information for Website B. In that sense, both storage mechanisms are equally secure. Problems can arise in terms of how ...


1

The safest way to store your access token is to simply not store it client-side at all. How does that work? Well at the point of generating the access token, generate some other cryptographically secure PRNG (which you map to the access token on the server), map this to the users session ID and return this to the client instead. This will reduce the attack ...



Top 50 recent answers are included