Secure way of opening web page from iOS without need of logging in

Question

I am developing an iOS application and web page, both use same Parse backend.

Web page contains some functionality that is not available in the iOS application. Therefore I would like to present the user an option to open home page from app. As user has already logged in before in the app I would like to skip the login process when home page is opened.

I have a solution in my head for which I would like your opinion. When the user clicks on a link in the app, the app would call e.g. generateToken function in Parse which would create a random token, store it DB with some expiration date for this user and return it to the app. The app would then open the web page with query parameter token=newly_generated_token or pass the token value in the http headers if that can be accomplished.
On new request the server code would check if parameter (or header) token exists, check the db for token value and log in the appropriate user where match would be found. Afterwards the token would be invalidated. If the request would not contain any 'token' parameter the usual authentication would go through and login page would display. All comunication would be over https.

I get rid of replay attack by invalidating token when used. Is it vulnerable to any other attacks? Or is there any other way of doing this?

Any help appreciated. Thanks!

Answer 1

Replay attack is only a concern if you're sending the token over a plaintext mechanism (HTTP), in which case the contents of the page would be available to the attacker as well. The technique you've described is sound, but you can even do it without needing the DB write. On the server side, you can simply compute an HMAC across a unique resource id (user id if it's one per user) and an expiration time. Upon receiving this token, the server can validate it as legitimate and verify that the token has not expired, then present the content to the user.

1. App calls /getToken?resource=foo
2. Server generates token: token = foo || now() + 15 minutes
3. Server signs token: h = HMAC(key, token)
4. Server returns signed token: token || h
5. App opens browser to /resource?token=token
6. Server validates that hash on token is valid for the requested resource at the requested time.
7. Server provides content to user's browser.