2

Consider this scenario

enter image description here

Step 1: App asks user to "Sign In" using Google or Facebook.
Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app specific data

Question

  1. Since the authentication is purely happening at the client level(iOS/ Android), there is no way for my server to know if user is a valid Google or Facebook user.
  2. The reason is that on the server if someone knows the API, they can easily play around with the system.

How do I handle such scenarios to make sure the server has confidence over the user data coming from Google/Facebook?

P.S: I am building a mobile application for the first time and this question may be a stupid one, but I don't know how to work with such a situation.

  • 2
    Look in to oAuth, it is covered pretty heavily here already. It covers how to handle authenticating a user against something like Google or Facebook. – AJ Henderson Jul 8 '14 at 13:25
  • Doesn't it also depends where are you authenticating. I mean I can authenticate on client, but needs assurance on server as well – daydreamer Jul 8 '14 at 13:28
  • you generally can't trust the client for authentication, though a local client may be able to have the server generate a token without additional user interaction. I'd personally probably skip the local authentication step and/or do them both simultaneously though. It's hard to say without knowing more about what your app needs to be able to do though. Big thing is you can't trust the client directly though, only Facebook or Google's server can tell you who the user is, even if that is via something that they give the client to give to you. – AJ Henderson Jul 8 '14 at 13:30
  • well, if app authenticates and gives you the user info, I still feel server should be able to validate the information. I thing I believe is do all the authentication on server only – daydreamer Jul 8 '14 at 13:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.