I’m working on mobile app which should have both good security and UX.

My backend stores credentials on its side. There is no 3rd-party auth services. Also the app shouldn’t have web views as part of auth process. And finally it should have long-lived session.

At first I was thinking about usual short access and long refresh token system. However, as long as mobile apps are downloaded on user devices I can’t be sure that someone won’t stole some of this tokens. So basically there is even no reason to make this two tokens.

So may be there’s some other way to authenticate user more securely with having features described above?

1 Answer 1


TL;DR: Refresh tokens are your best bet. StackOverflow has some ideas on how to improve the security.

If I understand you correctly, what you need is a mechanism by which the user can authenticate themselves to the app for whatever they need to do. You feel that access tokens can possibly be stolen by some other app or root user so you want something different.

There are two main approaches that you can take when authenticating users for their requests:

  • Ask the user to authenticate every time
  • Store some proof of authentication and use it

Clearly the first option is not going to be useful to you as you want a long lived session and its bad UX as well.

So you definitely need to store something somewhere. Instead of storing a user's actual credentials, I believe storing tokens that refresh is always better. You can read some relevant reddit and StackOverflow posts.

  • Thanks for your answer. I already thought about that. If someone can stole access token then there is no problem to stole refresh token too. So refresh tokens are not increasing the security at all. Commented May 7, 2018 at 4:21
  • @AlexeiMalashkevich what is your attack scenario for the stealing of access tokens? Like i mentioned in the answer, if you want a good UX, you will have to store something at least. If you are assuming anything stored in the phone can be stolen, then well you don't have anything else left other than having the user enter their credentials each time
    – Limit
    Commented May 7, 2018 at 12:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .