Prevent a desktop client application from abusing an API access token obtained through OAuth2 on behalf of an application

Question

I have the following use case:

• I want to write a desktop application that makes use of a third-party API (e.g. Dropbox)
• This API requires an access_token to be sent to the server with each request.
• This token gets generated on behalf of the user and my application using an OAuth2 authentication flow, which the user performs on my website.

Now, normally I would pass the generated access_token to the desktop application, where it can be used to make calls to the API. However, since the access_token is stored on the user's computer, he would be able to extract and misuse it for purposes not intended by the application (e.g. exceeding the API rate limit or performing malicious requests).

To resolve this, I could of course tunnel all the API traffic through my own server backend and thus avoid providing the user with the access_token. However, this would create large additional cost and would be a security risk for the client since his data would pass through an additional third-party service before going to the API server.

Is there any other way to keep the client from being able to retrieve the access_token, while still allowing him to use it in order to make requests to the API server?

I read about TCP connection passing, which would allow me to create a connection to the API server on my backend using the access token and then hand over that connection to the client, but this technique seems rather experimental and is probably not production-ready.

Another way would be to use asymmetric cryptography to somehow encrypt the access_token together with the URL on the backend server and let the client transfer this pre-encrypted data to the API server, but again I have no idea how to implement this using SSL.

Any ideas?

Edit:

I have thought about the problem and I think I have a solution, which would require a new API endpoint though and thus would not solve the initial problem:

http://www.andreas-dewes.de/en/2015/securing-api-calls-made-on-behalf-of-a-user-from-an-untrusted-environment/

Answer 1

Giving the desktop client the keys to the kingdom is by definition a violation of CWE-602: Client-side enforcement of server-side security. Any piece of software running on an attacker's machine cannot be trusted.

There needs to be an intermediary API, a web service that you control, and provides the ability to enforce user-based access control to a communal resource (files on DropBox).

You may also want to read the DropBox Terms and Conditions , which forbids resale of their service.

Answer 2

In your case, there really is no avoiding policing the API use yourself. Since the API is assigned to (you) the developer you will need to host some sort of server to provide access control to dropboxes API. Read Drop Boxe's terms of service carefully.