Long lived auth session for native mobile app

Question

I’m working on mobile app which should have both good security and UX.

My backend stores credentials on its side. There is no 3rd-party auth services. Also the app shouldn’t have web views as part of auth process. And finally it should have long-lived session.

At first I was thinking about usual short access and long refresh token system. However, as long as mobile apps are downloaded on user devices I can’t be sure that someone won’t stole some of this tokens. So basically there is even no reason to make this two tokens.

So may be there’s some other way to authenticate user more securely with having features described above?

Answer 1

TL;DR: Refresh tokens are your best bet. StackOverflow has some ideas on how to improve the security.

If I understand you correctly, what you need is a mechanism by which the user can authenticate themselves to the app for whatever they need to do. You feel that access tokens can possibly be stolen by some other app or root user so you want something different.

There are two main approaches that you can take when authenticating users for their requests:

• Ask the user to authenticate every time
• Store some proof of authentication and use it

Clearly the first option is not going to be useful to you as you want a long lived session and its bad UX as well.

So you definitely need to store something somewhere. Instead of storing a user's actual credentials, I believe storing tokens that refresh is always better. You can read some relevant reddit and StackOverflow posts.