2

I have two API's used in auth:

  1. api/auth/newtoken: Successfully validates user (i.e. username and password check in DB) and return token (expirers in 3 days) and refreshToken.
  2. api/auth/updatetoken: When the token is expired call this API with refreshToken and get the new token.

How can I protect the api/auth/updatetoken API? Currenlty these API's are for an Android application and it will be easy to get these API's once we decomplile the application.

What are some better approaches to secure this API?

Improve this question
2
  • Not sure what you are worried about here? That someone will find out the URL for updatetoken? Doesn't it check that the refreshToken is valid anyway?
    – Anders
    Nov 17, 2017 at 9:18
  • The main purpose of refresh tokens is when there is a third party that is providing claims which may change over time. It doesn't sound like that is the case here?
    – ste-fu
    Nov 17, 2017 at 9:23

1 Answer 1

Reset to default
2

There is no way to "protect" the API unless you control all devices which can connect to it. For an API allowing use by user owned devices connecting over the internet then you must assume anyone can send anything to it.

You have two choices here -

  • Don't expire the tokens and scrap the uptatetoken call.
  • updatetoken requires an existing valid token. If it has expired then newtoken has to be called again and the user has to reauthenticate.

Personally if there is no web browser client (and even with one - just I would give web browser clients an expiring token) I would suggest the first. The token should only sit on the clients device - stored in the device keychain - so should be secure. Meanwhile if anyone has intercepted it they could just call updatetoken themselves to stop it expiring.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .