I have two API's used in
api/auth/newtoken: Successfully validates user (i.e. username and password check in DB) and return
token(expirers in 3 days) and
api/auth/updatetoken: When the token is expired call this API with
refreshTokenand get the new
How can I protect the
api/auth/updatetoken API? Currenlty these API's are for an Android application and it will be easy to get these API's once we decomplile the application.
What are some better approaches to secure this API?