1

I am developing an iOS application and web page, both use same Parse backend.

Web page contains some functionality that is not available in the iOS application. Therefore I would like to present the user an option to open home page from app. As user has already logged in before in the app I would like to skip the login process when home page is opened.

I have a solution in my head for which I would like your opinion. When the user clicks on a link in the app, the app would call e.g. generateToken function in Parse which would create a random token, store it DB with some expiration date for this user and return it to the app. The app would then open the web page with query parameter token=newly_generated_token or pass the token value in the http headers if that can be accomplished.
On new request the server code would check if parameter (or header) token exists, check the db for token value and log in the appropriate user where match would be found. Afterwards the token would be invalidated. If the request would not contain any 'token' parameter the usual authentication would go through and login page would display. All comunication would be over https.

I get rid of replay attack by invalidating token when used. Is it vulnerable to any other attacks? Or is there any other way of doing this?

Any help appreciated. Thanks!

|improve this question
2

Replay attack is only a concern if you're sending the token over a plaintext mechanism (HTTP), in which case the contents of the page would be available to the attacker as well. The technique you've described is sound, but you can even do it without needing the DB write. On the server side, you can simply compute an HMAC across a unique resource id (user id if it's one per user) and an expiration time. Upon receiving this token, the server can validate it as legitimate and verify that the token has not expired, then present the content to the user.

  1. App calls /getToken?resource=foo
  2. Server generates token: token = foo || now() + 15 minutes
  3. Server signs token: h = HMAC(key, token)
  4. Server returns signed token: token || h
  5. App opens browser to /resource?token=token
  6. Server validates that hash on token is valid for the requested resource at the requested time.
  7. Server provides content to user's browser.
|improve this answer
  • But isn't there a risk if e.g. someone else opens the same browser before 15min, sees in browser history the token and can potentially reuse it and gain access? – tmin Jun 11 '14 at 6:18
  • The browser on the user's iOS device? Seems like someone has bad physical security... :) Yes, this is a risk, but you can make the time window smaller since you're not waiting on user input (even, say, 1 minute should be enough for high-latency situations) or you can do as you originally stated, but that increases write load on the DB. – David Jun 11 '14 at 6:30
  • Yeah, well... it could happen. I cannot control my users :) So using some short time window is probably quite safe way to go. – tmin Jun 12 '14 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.