I have been doing some research about using OAuth2.0 on our mobile application, but I'm really having trouble deciding whether OAuth2.0 really is the best choice.
Since we are not interacting with any 3rd party, we don't really have to go through the Authorization stage to authorize the third party resource.
One other requirement for our app is that a user should stay logged in indefinitely.
So my focus is on the next step. But my research so far tells me that OAuth workflow is really not that secure. A refresh token can be easily captured by connecting your device through a proxy like Fiddler.
I mean if someone is going to spend the effort to connect to a proxy, chances are they are willing to spend the effort to capture the refresh token, client secret and client id.
PKCE extension only limits the impact to possibly a single user.
So in my mind, using OAuth 2.0 is really not more secure than the traditional way of storing a session token, once you deactivate a token, security risk is mitigated. Blacklisting a refresh token still gives attacker some time (however many minutes is left on their JWT token)
It introduces all the complexity of refreshing a token, and dealing with token change when the app has been offline for a while etc...
So my question is: for a mobile app that keeps a user logged in indefinitely, is there a point in using OAuth2.0?