I have a running web app that uses an external OAuth provider (Reddit) to log in with. I want to integrate this app with someone else's mobile app and I want to make it as easy as possible for developers and users. I don't want to have to display multiple OAuth confirmation windows and store multiple tokens if I don't have to.

My question is, what are the security concerns around re-using an access token for multiple apps? Could the mobile app simply pass a currently valid, Reddit access token to my web app and I use that instead of fetching my own refresh and access token from Reddit? Would that create security concerns since the token is technically being re-used even though it's by the same "app family"?

The token would be passed in a header to the web app / API and the web app and the mobile app would then share the same app secret.

My gut says this probably isn't a great idea and/or against most ToS. But this would be a much simpler solution than having to manage another token in mobile app just so it could talk to my web app.

  • 1
    I don't think this question fits on this site. – ThoriumBR Jan 18 '17 at 21:46
  • An access token is in effect a password of sorts. How would you pass this token around? Also, an access token is based on an Auth Server generated secret key that represents the app. The two apps being integrated would have different secret keys, correct? – katrix Jan 18 '17 at 22:23
  • Your situation screams to be a security question (token reuse), but your actual question isn't (etiquette/rules/ToS). That makes this a difficult question to answer. Can you take another stab at what you really want to ask? – schroeder Jan 19 '17 at 7:39
  • @schroeder I've updated the question as you're right I was a little vague/off topic there. – Matti Price Jan 19 '17 at 17:16
  • If reddit doesn't mind who's the client using the token, then the only concern is to keep the token of secure (during transportation between the services and storage). – luben Mar 5 '17 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.