I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For Authorization we are using OAUTH 2 and are storing the token in a HTTP only Cookie and are also using XSRF protection ( Cross Site Request Forgery Protection )
We also got a request, to create a mobile app. I didn't find any clear material on how to expose the REST Api to the mobile app, without creating a possibility that a hacker could create a fake client that could impersonate our service, and fool Users into logging in using the fake client.
Let me explain more. Let's assume the following scenario.
The api is hosted on api.com . The api has two endpoints
/Token -> this endpoint will generate a JWT token, if the credentials passed with POST are valid
/GetData -> this is an endpoint, that will be accessible by an authorized user.
the single page app is hosted on spa.com.
Our security architecture is based on this article . The main idea is that it's unsafe to store jwt tokens in the localstorage and we should leverage the cookies for this. The api will set two cookies after a successful request to /Login
- A http only cookie, that contains the jwt token. This cookie will be passed in the following request only to the domain of the API.
I'm not a security expert, but based on reading an materials from stormpath and others, I think that this is a decent security architecture for the web app.
Second Scenario, mobile app.
As I said, the API checks for two tokens, in order to authorize a user. Let's imagine, there is a third endpoint on api.com:
- /TokenMobile -> this endpoint will get the credentials that are send by a mobile app.
As we all know, mobile apps are not safe. They can be decompiled. SSL can be circumvent. An hacker, with enough time and knowledge could figure out how i'm doing all my requests, and how i'm authorizing a user. This hacker could build a makeshift website that looks similar to our app, and use the mobile endpoints to login the user. Of course, this can be possible with some social engineering .
So my questions: Am I missing something? Can I protect my users from service impersonation? Am I paranoid? Is this use case really a security problem?