2

So I'm trying to create and secure a mobile REST API on an existing server that runs our web app. We're not going to open the API to the public and we will be writing the client app using PhoneGap/Javascript/HTML. We could very well use HTTP Basic but I wanted something a little more advanced and secure. I do not want to use OAuth or Amazon's AWS security as those seem to be mainly for opening up your API to the public or a 3rd party.

I'm really new to REST APIs and security, but after doing some research I plan to use this implementation as written by Google. I'll sum up the general idea:

  • User sends the server credentials through a secure POST
  • If the credentials match. The server creates a token, saves it in the database, then sends it back to the user. The token will be based on the user's UUID and a timestamp.
  • The database will store the last time the user changed their password and will only validate calls with tokens that were issued after that time.
  • The user then sends this token in the header with each API call

How secure is this implementation? How do I stop brute force attacks on my authentication method? Any other suggestions or recommendations are appreciated.

1 Answer 1

1

The security of this solution depends on the security of two elements:

  • The connection: If you're using SSL then the problems linked to connection security are well understood (if not always easy to evaluate): client-side root store quality, proper key exchange, use of secure protocols, etc.

  • The token itself. First, it needs to be generated in a way that makes it difficult to guess and impossible to reuse. It also needs to be protected while on the client system (this is more of a problem in a web application than on a dedicated client but needs to be mentionned).

Assuming that both aspects of the problem are properly handled, then yes, such an implementation is pretty secure.

3
  • So how do you keep the token secure on a mobile phone? Is local storage good enough?
    – Drew S
    Nov 12, 2013 at 21:10
  • That's a rather different question and the answer will depend on what mobile platform you're talking about, how long you want to keep the token around, what you want to protect it against and probably the value of what you're protecting.
    – Stephane
    Nov 13, 2013 at 8:21
  • Well I'll be using PhoneGap so it would just be the local storage API. I want to protect it against someone besides the user of the app getting access to it. The value of the data is not super critical, but as an exercise I want to make this secure as possible.
    – Drew S
    Nov 14, 2013 at 8:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .