• In my application, I build REST APIs so that user can interact with my application server.
  • Since I do not want to maintain User/Passwords, my iOS app authenticates client using Google. This all happens on iOS device

  • Once client is authenticated, I would give a call to my app server to fetch user's data. The problem lies here.

  • Now the user is authenticated on mobile client, but on server, I have no idea if the request is coming from a valid user or not.

What are some mechanisms recommended to build trust between mobile client(authenticated with OAuth) and my server APIs


If you mean "trust" in the communications sense, you're defending against man-in-the-middle attacks, and that means using HTTPS. For bonus trust, use certificate pinning in the mobile app.

If you mean "trust" in the "server wants to ensure that the client has authenticated" sense, you should read more about OAuth. The short of it is that

  • Your user will authenticate with Google on the mobile device, thus acquiring an authorization grant.
  • Your mobile app will tell your server that the user authenticated, and send along the authorization grant.
  • Your server will give the authorization grant to Google.
  • Finally, Google will tell the server whether or not the user actually authenticated.

After that, you can issue the mobile app a session token and proceed as usual.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.