0

Preface: I have no experience with securing applications whatsoever.

I'm building a web app that uses Google Plus authentication to sign users in. My initial thought is to save the access token that gets returned after sign in and store that on my server and use it as an access token for my web app.

I have a concern that this isn't very secure. Anyone who is watching network traffic on my web app can see the token (in headers) and can copy it and form their own malicious calls. Even if the request was encrypted, isn't it possible for it to be unencrypted?

On the other hand, an attacker would need to have their victim signed in already which would imply physical access.

1 Answer 1

1

Anyone who is watching network traffic on my web app can see the token (in headers) and can copy it and form their own malicious calls.

That is correct. This is why you would want to make sure you use a secure connection (HTTPS in the URL), which will prevent man in the middle attacks.

4
  • What is the likelihood of someone decrypting the request?
    – Alex Fu
    Oct 15, 2014 at 17:50
  • If you are using a secure connection? Oct 15, 2014 at 18:11
  • Yes, if a secure connection is used. Or am I just being paranoid?
    – Alex Fu
    Oct 15, 2014 at 18:15
  • Very unlikely, unless you are doing something screwy. Oct 15, 2014 at 19:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .