Currently, there are two common auth flows i know:
- Resource Owner Password Flow
- Authentication Code Flow + PKCE (didn't mention other, since this one is more robust within redirect-based)
This theme was discussed long and across, but for primitive non-security-expert guy like me it's not clear, why should i ditch ROPC for Mobile and SPA apps:
- which my team develop itself and trust
- which performs authentication (and further authorization) via OIDC self-hosted by the same team
- which uses accounts only from our self-hosted OIDC (keycloak, mb hydra) and registration performed there too
- with no plans to support third-party auth providers or SSO
- which operate only via https and server-side use only Let's Encrypt certificates
- with ports protected/ssl-verified by nginx (in fact there are 3 layers with token presence checks and jwks)
- with ports protected against some very common attacks by ufw
My understanding is that ROPC vs ACF + PKCE (in common systems like ours) is more about human mistakes which may be allowed during system design ?
If Attacker finds out victim's password, there is no difference between ROPC and redirect-based flows, if so, why should i care about ACF at all ?
Even if server's private key got somehow leaked, during the MITM Attacker doesn't need any code challenge parts, he can just install this App and authenticate via leaked user password to get the data.
If my understanding meet the reality, am i missing some even straight algorithm, than self-hosted OIDC and ROPC ?
I'm definitely vote for redirect-flow, but this approach is so unmatured (in terms of software) nowadays, that users always suffer from Android and IOS bugs during second redirect, browser versions, installed custom protection software on their phones and the abyss of other App <-> Browser interaction issues during auth.
I encountered issue myself even authenticating on Amazon.