2

Users authenticate with their phone number, get a pin text, and if it is correct, they get an access token. Store the access token in a DB in a Token model. The client always sends the access token in an Authorization header. For requests that require authentication, parse the header, check if it is in the database, and pull up the user id (also stored in the Token model) based on the row. Assuming the user_id exists and the token is marked as still valid, complete the request.

Everything is over HTTPS. Tokens have no expiration. If it is invalid, I delete the token on the client and then the user would be prompted for another. Tokens are just random, long alphanumeric strings

Is this reasonable? Is it secure? Should I use some preexisting paradigm?

  • Secure against what? What's your threat model? – schroeder Apr 14 '15 at 20:11
  • I'm not sure exactly. What should I be aware of? I don't have much experience with security, so I am trying to learn as I go – mergesort Apr 14 '15 at 20:23
2

Users authenticate with their phone number, get a pin text, and if it is correct, they get an access token.

Phone numbers are PII, so you should be keeping them safe (encrypted?). Text messages are sent in the clear and are readable by smartphone applications, consider that. Also, are the pin numbers random or can they be deducted easily? Are they valid indefinitely?

The client always sends the access token in an Authorization header.

So if the token is stolen, can the session be spoofed from another phone number?

Everything is over HTTPS.

Consider testing your TLS settings. Default settings are not secure in most cases. There are online services that help you with this.

Tokens are just random, long alphanumeric strings

How random, how long? Can the token be brute-forced? Do you hinder login attempts after a few failed ones?

Is this reasonable? Is it secure?

As a commenter asked, what is your threat model?

Should I use some preexisting paradigm?

Yes. Don't roll your own.

  • What attacks should I be concerned about? What preexisting paradigm should I use? Oauth2? Any advice/direction on what paradigm I should use? I've currently rolled everything on my own. – mergesort Apr 14 '15 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.