We have an existing single-page web application powered by ASP.NET WebApi endpoints. These endpoints leverage SimpleMembership and Forms Authentication to handle authorization and authentication:

    public HttpResponseMessage LogIn(LoginModel model) {
        if (!WebSecurity.UserExists(model.Username))
            return Request.CreateResponse(HttpStatusCode.OK, new ApiResponseDto() { Success = false, Error = "Email or Password is incorrect." });
        if (_userService.LoginWork(model.Username) && WebSecurity.Login(model.Username, model.Password, persistCookie: true)) {
            return Request.CreateResponse(HttpStatusCode.OK, new ApiResponseDto() { Data = true });
        return Request.CreateResponse(HttpStatusCode.OK, new ApiResponseDto() { Success = false, Error = "Login Failed" });

We are now developing a native iOS app and would like to reuse these API endpoints in the name of simplicity. To do this, we're using CSRF tokens as well as cookies to handle auth from both native and web apps.

I like the idea of keeping things simple and not rewriting ~100 API endpoints just to support mobile, but not if I have to compromise around security. Is this solution "as secure" as the standard implementation of say a pure OAuth2 token-based implementation? If not, why?

1 Answer 1


Sure, why wouldn't it be? You just lose (a lot of) the flexibility that is included in the many use cases of OAuth, which I assume you do not need. In particular, if you only care about your own app, and not about delegating access to others and/or allowing users to login with other identity providers, then you are just fine with this set-up. That said, if you are going to upgrade in the future, upgrade to OpenID Connect, instead of 'pure OAuth'.

A couple of remarks:

  • You will likely need to store the authentication token (which you normally include in a cookie) in some local storage of the device, as cookies do not exist in native apps. So you might need some kind of 'translator' in your app which catches the 'set-cookie' command and stores its value in the local device storage. Likewise for the other way around.
  • CSRF attacks do not exist in real native apps. However, if you use the same endpoints for both browser and app, you'll likely need to keep using them.
  • Use HTTPS (and possibly HSTS and HPKP) to secure your tokens during transport.
  • I would like to understand: 1. Why "cookies do not exist in native apps"? Can't native apps just store the cookie in their local storage, as they would with auth tokens? 2. Why "CSRF attacks do not exist in real native apps"? If the app supports deep links from anywhere to app, I think CSRF attacks are still possible.
    – onepiece
    Jun 7, 2021 at 18:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .