0

I am creating an Android application to interact with a webservice. Is it fine if I transmit the server side api credentials as plaintext that is used to authenticate a webservice?

The application has a search functionality and it uses username and password to generate an authentication token.

POST /HTTP/1/1
Accept: application/json
client_id:
client_secret:
Content-Type: application/json
Content-Length: 53
Host:
Connection: close
User-Agent: okhttp/3.7.0

{"Username":"XXXXXXXXXXXXXX", "password": "XXXXXXXXX" }
Improve this question
3

1 Answer 1

Reset to default
2

Once you have established a connection over SSL/TLS, you can send secrets over that channel - that's the point of SSL/TLS.

However....

It looks like you are using OAuth, with the "Resource Owner Password Credentials" flow. If you do this, there are a few things to consider.

There are several flows, and this particular flow expects the highest amount of trust from the end user. If possible, you should consider one of the other three flows.

It's better not ask the user to send their password to your own server, or to ask the user to enter their credentials in a screen belonging to your app.

The web service you use should provide a login screen to use for OAuth authorization. You should redirect the user to that login screen, and let the web service handle the login process. It should then provide you with the token needed to complete authorization.

Improve this answer
4
  • Considering the fact that user is using a search feature and search-api requires authentication from the application-side not the user side. Is it okay to send as plain text.
    – Mohammed Farhan
    Commented Nov 23, 2017 at 14:28
  • @MohammedFarhan Technically, once you sent them over SSL/TLS, you're not sending them as plaintext. SSL/TLS encrypts them for you. So you can send the credentials that the user gave you. But, if you have the time, check if you can use the Authorization Code grant instead of Resource Owner Password Credentials grant.
    – S.L. Barth is on codidact.com
    Commented Nov 23, 2017 at 14:32
  • An attacker can intercept using a proxy application to get the credentials thus allowing him to reuse the api.
    – Mohammed Farhan
    Commented Nov 23, 2017 at 14:37
  • @MohammedFarhan That is a Man-In-The-Middle (MITM) attack. SSL/TLS protects against this using certificates. This attack is possible, but requires the end user to install the attacker's certificate.
    – S.L. Barth is on codidact.com
    Commented Nov 23, 2017 at 14:40

Not the answer you're looking for? Browse other questions tagged .