2

I'm creating a simple Android application which requires reading and writing values to the cloud. I intent to use PHP for the webservice.

But I'm a little confused over the authentication scheme. I intent to host a script at www.mycoolsite.com/magic.php and POST data to it from Android.

What is the best way to authenticate a user with the server, should I send the username and password with every HTTP POST (encrypted)? Also, if there are large number of users using the same script at a time, will there be some concurrency and efficiency issues?

  • I understand that I can use REST to generate tokens, but I don't know how this works to generate the token. Do I need to send the username and password to the server once?
  • So if an intruder gets hold of this token, can't the intruder send bogus requests. Is this token encrypted?
Improve this question

1 Answer 1

Reset to default
1

You want to use an encrypted channel (SSL for example) for the login and give some type of a session identifier back to the application. That session identifier should then either be used to sign later requests or can simply be included with the requests as long as it is provided over a secured connection (such as SSL).

The easiest way is just to do everything over SSL so that only the client and server can take part in the communication and the client can verify itself while only having to login once.

Improve this answer
10
  • I will need to get a static ip for that,will add to the development cost.
    – techno
    Feb 13, 2014 at 5:09
  • 1
    @techno - why? SSL certs are based on the host name, not the IP address. Or do you mean you will need a dedicated IP? If you are using a shared host, then you need an IP address all to yourself to hook up the SSL cert to, but it can be a dynamic IP as long as it remains one that you are the only SSL user on. You can also use a self-signed certificate since you client application will know the valid thumbprint.
    – AJ Henderson
    Feb 13, 2014 at 6:31
  • Techno, SSL is important. Without it anyone can read the token and impersonate a user. I would also caution against running a secure app on a shared server. At least consider a fully emulated VPS (not jailed shell)
    – Daisetsu
    Feb 13, 2014 at 22:45
  • @AJHenderson Yeah,I mean the dedicated IP and the cost of a SSL Certificate.I dont have funds to pay for it,since what im just building a prototype.I think of hosting this on Azure.So i think of implementing an asymmetric cryptography maybe with RSA to send the uname and password encrypted with the public key of the server.I know RSA has size limitations but,i think it will be able to handle most usernames and passwords right?
    – techno
    Feb 14, 2014 at 3:45
  • @Daisetsu Well what if i encrypt the token,myself with public key of the server?Running on Azure.
    – techno
    Feb 14, 2014 at 3:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.