I am working on an IoT device and companion app to control features on the device. I'm using an ESP32 MCU - http://esp32.net/

I've implemented a JSON REST API on HTTPS over TLS 1.2 with a self signed SSL cert from an RSA 2048 key both generated on the ESP32 device.

I would like to secure the API against unauthenticated use.

When the device starts for the very first time the user must configure it to connect to WiFi by connecting through the app to an SSID the device broadcasts.

I plan to share a string token generated on the device over an API only available when connected directly to the device via its SSID. This token will then be used in future requests to authenticate when the device is connected to WiFi and the internet. The device stops broadcasting an SSID after initial setup.

What are the weaknesses of this approach? Are there more secure ways to do this given the constraints of the ESP32?


You must log in to answer this question.

Browse other questions tagged .