I'm quite a newbie at security.
I'm developing an android app with a token based approach to authentication. I'm not using Oauth as the OAuth 2.0 is not an authentication protocol but rather used to delegate authorisation: http://oauth.net/articles/authentication/.
Since I don't really want anyone else to use my API, I do not need to delegate authorisation so I have decided not to implement Oauth.
This is the flow:
- The user passes a username and password to the server using SSL
- The server verifies the username and password and passes back an authentication token using SSL. The authentication token is a random set of characters
- The authentication token is saved on the app and then sent back to the server each time a REST request is made using SSL
My question: are refresh tokens relevant in this scenario?
The authentication token is already encrypted through SSL and replay attacks or man-in-the-middle are not possible.
Also the authentication token is used only for access my API and not used subsequently in any further API calls from server to server (like for example, if I call the google maps server from my server, I don't use my authentication token to make the call - the token is unique for my server).
I could make the flow more secure by hashing the authentication token and sending that over to the server so that the server can check whether the hash of the token stored matches the hash sent by the app...
Why to use refresh tokens when your authentication token is securely transmitted through SSL?