From Google's Cross-client identity document:
Cross-client access tokens
The effect is that if an Android app requests an access token for a particular scope, and the requesting user has already granted approval to a web application in the same project for that same scope, the user will not be asked once again to approve. [...]
This seems unsafe. The server-side app is able to do a more secure form of OAuth authorization, because it can protect its client secret. An Android app's OAuth flow is less safe, since an attacker can always decompile the binary and steal any embedded tokens.
This is the scenario I'm worried about:
- I register two client IDs, one for my server-side web app and one for my Android app.
- User X authorizes my server-side app.
- An attacker steals the Android app's OAuth-related tokens.
- The attacker sends user X through the OAuth flow using the stolen tokens, and Google doesn't ask for approval.
- The attacker now has an access token to user X's account.
Am I misunderstanding something here?