I am designing a .NET Web API-based REST API that would be accessed via a mobile banking-like app.

We plan to use OAuth 2.0 Resource Owner flow for authorization. All requests will go through HTTPS with server certificate and will include the signed refreshable access-token received by the Authorization Server.

What other security measures should be implemented by the API and the mobile client in this security context.

Is request key-HMAC signing similar to AWS necessary? Is message encryption necessary? What do mobile banking apps typically implement in this scenario? Is it necessary to track app installed instances (by having them send a Guid with the access-token request)

A specific real-world set of instructions recommended for mobile banking APIs would be greatly appreciated. How do Chase, Wells Fargo, Bank of America, etc. do it?

  • 5
    This is one of those cases where if you need to ask the question you should not be building it. I'd advice you to hire some experienced consultants rather than asking this on the Internet. Get a security architect involved. If you can't afford a security architect then you should not be building this. – Lucas Kauffman Jul 12 '13 at 4:54
  • 1
    This is a bit of a broad list question. Let's see how it goes but I don't think it is answerable in current form without writing a few books, copying policies and standards etc. Could you try and narrow it down a bit. – Rory Alsop Jul 12 '13 at 9:45
  • +1 for @LucasKauffman's comment. Since you asked how Chase, Wells Fargo, And Bank of America do it...They each have entire teams of security professionals to continually validate every decision they make and every application installed in their environment. They also extensively train their developers in security and secure development methodologies. If you want to build a banking application, that's the approach I'd suggest you take as well. – Xander Jul 12 '13 at 13:44
  • 1
    So nearly two years later, did you learn anything? Was OAuth2 with TLS enough or did you add additional security measures? – Jeff Jun 17 '15 at 1:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.