I would like to know how auth services, such as OpenID Connect and OAuth, are able to distinguish between a first party application over a third party one - in particular for clients such as mobile applications, since they obviously can't securely hold some predefined key/identifier.

An example of this would be the Google auth system. When signing in for gmail, there's no prompt regarding scopes; contrast to StackExchange using Google for an account which would show developer info and requested scopes.

I can understand how this could work for an SPA since you could set restrictions around the redirect URL but how would you ensure that the request was coming from a particular mobile app? Is that even possible to truly do securely?


It's possible to make this harder, but it is not possible to entirely prevent it - just tell developers to use your API but assume that it is possible for them to ignore your suggestion.

Google for an example offers a separate API for OAuth, which most websites/apps use, because that's what they are intended to use. However, it is still possible to create an app that logs "directly" into your Google account, if somebody really wanted to.

  • I thought this might be the case, thanks for confirming. Is there much you can do outside of obfuscating an API key inside the app? – Tyson May Jan 29 '20 at 10:08
  • You can obfuscate the app a ton and implement other security measures, but this would be security through obscurity and would eventually get cracked anyways. Since your main concern seems to be holding a secure key/identifier, just make sure the end-user gets your app from a legitimate source – rebane2001 Jan 29 '20 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.