OAuth2 Client Credentials & Native Apps

Question

The OAuth2 spec seems to consider native (Android & iOS) apps as "public clients", ultimately meaning that they can't use the "client credentials" flow. That being said, how does one go about requiring authentication on endpoints that expose client-owned (as opposed to user-owned) resources?

In my scenario I'm developing a REST API that exposes a few endpoints that do not need user authentication but which I'd prefer not to leave "open" (i.e., I'd like to require some form of authentication to prevent abuse). Presently I'm using the "client credentials" flow with an empty password, but I feel this is a violation of the protocol. Am I doing things wrong?

Answer 1

OAuth2 with "client credentials" without a password in your scenario sounds fine. This allows you to add additional more secured oauth based grant-types in the future.

I would recommend to look at adding controls for abuse - by throttling requests. This would protect against Denial of Service attacks, limit number of connections over a period of time (using quotas), or limit number of concurrent connections (rate limits). This kind of protection is typically done by using API gateways like a127 or volos.