415 reputation
1612
bio website
location Glasgow, United Kingdom
age
visits member for 2 years, 6 months
seen 2 days ago

Dec
16
comment Token-based authentication - Securing the token
Couple of things - who said I wasn't utilising the authorization header? Token authentication is still stateless, the server remembers nothing beyond the current request - the token is simply used as a ticket to say "hey, I've been before, he's the proof, so you can skip the authentication step".
Dec
11
awarded  Yearling
Jul
24
awarded  Favorite Question
Jul
2
awarded  Curious
May
30
awarded  Critic
May
30
awarded  Citizen Patrol
Mar
20
awarded  Good Question
Jan
9
awarded  Famous Question
Oct
9
awarded  Notable Question
Jul
31
awarded  Nice Question
Jul
31
awarded  Nice Question
Jun
7
awarded  Yearling
May
18
awarded  Notable Question
May
17
awarded  Popular Question
Mar
29
comment Would introducing client certificates for a mobile app improve security?
Interesting, this is exactly what I am doing at the minute. When a user registers the server generates a public/private (aka API/Secret) key which is sent back to the client all over SSL. The public key is then sent as a header in the request and the private key is used to generate a signature (based on the request data). The server then uses the public key to locate the user, uses the secret stored on the server to re-generate a signature (using request data), if the signatures match, the request is authorised. Both keys are stored on the client securely in a keystore.
Mar
27
comment Would introducing client certificates for a mobile app improve security?
Isn't it a valid case though to have a server which is also a CA? Essentially what I am trying to achieve here is from the servers POV, make sure I only accept requests that come from my mobile app (I thought client certs would have been the solution to this). From the clients POV, I want to make sure I am talking to the correct server. Could you suggest a robust way of solving this issue without using client certs?
Mar
24
asked Would introducing client certificates for a mobile app improve security?
Feb
22
awarded  Popular Question
Sep
17
accepted How should API keys be generated?
Sep
8
comment How should API keys be generated?
what do you make the following approach?