We have a mobile app that communicates with our server via a RESTful HTTPS API. We also have an attacker pretending to be our app while attempting to communicate with our web services API.
We assume that our app in the wild can be reverse-engineered to obtain any API keys, shared secrets, private keys, etc.
My question is: Can OAuth2 help to authenticate the app? I'm not asking about authenticating the person. This is not about security of the mobile app. We have to assume the mobile app can be compromised.
In other words, on the server side, how do I distinguish between a legitimate request coming from our app, and an attacker pretending to be the app?
It's been suggested that OAuth2 will help. I don't think this is the case. I don't think OAuth2 is relevant to the problem I'm describing.
I looked at RFC 6749 Implicit Grant flow. To be sure, it does not require a client secret. But its whole point is to log in one place and use that authorization elsewhere. We already do that through our own API. We're not trying to an OpenID Connect sort of thing, just protect our API from attackers.
Can someone confirm that OAuth2 does not help us, from the server side of the equation? Or, if I'm mistaken, please do explain!