From Google's Cross-client identity document:

Cross-client access tokens


The effect is that if an Android app requests an access token for a particular scope, and the requesting user has already granted approval to a web application in the same project for that same scope, the user will not be asked once again to approve. [...]

This seems unsafe. The server-side app is able to do a more secure form of OAuth authorization, because it can protect its client secret. An Android app's OAuth flow is less safe, since an attacker can always decompile the binary and steal any embedded tokens.

This is the scenario I'm worried about:

  1. I register two client IDs, one for my server-side web app and one for my Android app.
  2. User X authorizes my server-side app.
  3. An attacker steals the Android app's OAuth-related tokens.
  4. The attacker sends user X through the OAuth flow using the stolen tokens, and Google doesn't ask for approval.
  5. The attacker now has an access token to user X's account.

Am I misunderstanding something here?

  • 1
    Step 3 is impossible, because there is no token within the app. "an attacker can always decompile the binary and steal any embedded tokens." - no one suggests hard-coding a particular token value within the binary, for the same reason that you don't embed a client secret. What makes a mobile app less safe is that it has to rely on less-straightforward means of client validation, namely claimed https redirection. – Jake Feasel Feb 7 at 23:56
  • @JakeFeasel: I mentioned the bit about stealing "tokens" to cover the old OAuth 1.0 case where the secret was required. But yeah, nowadays native flows only use the client ID and a redirect whitelist. I guess my question is basically that the non-server flows are riskier, so it seems dangerous to allow a native app approval to count as a server-side app approval. – Kannan Goundan Feb 8 at 22:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.