Is it safe to use the following stateless authorization mechanism between a client (iOS & Android) and server?
The client provides an email and password and saves the clear password on the
Keychainof iOS and using some alternative for Android.
The server checks the password strength if it's deemed strong enough the user is created on DB.
The server generates a
JWT tokenand returns it to the client. The token has an expiration time of 15 minutes.
The client stores the token (maybe on the
Keychainitself) and includes it for each following request on the
For each request, the server checks the token provided (checks the signature and the expiration time). If it's ok the request is processed, otherwise, an
HTTP 401is returned.
When the client receives an
HTTP 401from the server it means a login is required. So the app accesses to the
Keychainand gets the email & password and sends it to the server (no user intervention needed).
The server validates the credentials provided and if they're valid it will repeat the Sign Up steps from 3 to 5.
Thanks to expiration time on the token, if a token is compromised it will be valid during a short time period.
If a user is logged on multiple devices and she changes her password from one device, the other devices will keep logged only for a short time period, but the clear password stored on the
Keychain will not be longer valid. So a new manual login will be required, which I think it's fine.
Which drawbacks do you see?
I've been thinking on using refresh token procedure to avoid store the clear password but this adds complexity and other drawbacks (for example: how to guarantee the
refresh token is only used once). And as far as I've seen, storing the clear password on the
KeyChain is secure enough:
But I also have seen other questions that do not recommend storing passwords on the device.
So I would like to hear opinions from others on this.