I’m working on mobile app which should have both good security and UX.
My backend stores credentials on its side. There is no 3rd-party auth services. Also the app shouldn’t have web views as part of auth process. And finally it should have long-lived session.
At first I was thinking about usual short access and long refresh token system. However, as long as mobile apps are downloaded on user devices I can’t be sure that someone won’t stole some of this tokens. So basically there is even no reason to make this two tokens.
So may be there’s some other way to authenticate user more securely with having features described above?