0

I need to develop iOS and Android apps that should have to communicate with a server throught RESTfull API. Also I need to register and authorize user throught popular social networks like Facebook, Twitter, Google.

What is the best scenario of doing that? For example: I generate access_token in my mobile app and then sending it to the server like example.com/auth?google?<access_token>. Could somebody stole my access_token then get access to the user's personal info or to the user's account?

  • 1
    I'm having trouble following your question. How will the access token be used? Where did it come from? – Neil Smithline Jan 16 '16 at 21:11
  • 1
    Have you looked at examples for integrating with those services? You can find many good examples and maybe even a library to support you in that. – Neil Smithline Jan 16 '16 at 21:11
  • @NeilSmithline, it generates in mobile app after user has been authorized thought Oauth and then used on the server to register or authorize user by and allows to get user's info from that social network – Near1999 Jan 16 '16 at 21:21
  • @NeilSmithline, yes I do, but i didn't find useful information – Near1999 Jan 16 '16 at 21:24
  • I'm sorry Near, but I still don't follow. How is the access token generated? How does the server validate it? What data does it contain? How can it be trusted? – Neil Smithline Jan 16 '16 at 21:27
0

The token that you are speaking about is not generated in the mobile app. It is generated in the 3rd-party authentication servers and passed to your mobile app. Your mobile app has to pass it back to the servers to validate your apps's authorization.

Regarding security of the token, assuming that you are using SSL, you can pass the token in either a query parameter as you suggest or as a message header. The Authorization header is the standard one to use, but, as you own both the mobile app and your server, you can put it in any header.

My preference is to never put anything that needs to be kept secure in a query parameter. URLs have a nasty habit of getting exposed via logs or other mechanisms. So I prefer using the header.

When you communicate with the 3rd-party servers like Google, you'll have to use whatever mechanism they require.

| improve this answer | |
  • I meant that I'm getting access_token on the mobile client, it generates on the 3rd-party servers as you said. – Near1999 Jan 17 '16 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.