Is this system of authentication secure for a mobile app? What can I do to improve it?

Question

Users authenticate with their phone number, get a pin text, and if it is correct, they get an access token. Store the access token in a DB in a Token model. The client always sends the access token in an Authorization header. For requests that require authentication, parse the header, check if it is in the database, and pull up the user id (also stored in the Token model) based on the row. Assuming the user_id exists and the token is marked as still valid, complete the request.

Everything is over HTTPS. Tokens have no expiration. If it is invalid, I delete the token on the client and then the user would be prompted for another. Tokens are just random, long alphanumeric strings

Is this reasonable? Is it secure? Should I use some preexisting paradigm?

Answer 1

Users authenticate with their phone number, get a pin text, and if it is correct, they get an access token.

Phone numbers are PII, so you should be keeping them safe (encrypted?). Text messages are sent in the clear and are readable by smartphone applications, consider that. Also, are the pin numbers random or can they be deducted easily? Are they valid indefinitely?

The client always sends the access token in an Authorization header.

So if the token is stolen, can the session be spoofed from another phone number?

Everything is over HTTPS.

Consider testing your TLS settings. Default settings are not secure in most cases. There are online services that help you with this.

Tokens are just random, long alphanumeric strings

How random, how long? Can the token be brute-forced? Do you hinder login attempts after a few failed ones?

Is this reasonable? Is it secure?

As a commenter asked, what is your threat model?

Should I use some preexisting paradigm?

Yes. Don't roll your own.