Menu
I am tasked with designing a system that will allow our users to also sign in to their accounts and interact with our service using their mobile phones. I am concerned about the security of the application though.
Basically, we allow people to login via OAuth using Facebook or Twitter. The mobile application (built with Appcelerator titanium) should do that too. Upon a successful login on the phone, I need to notify my app that someone logged in with FB or Twitter so that my app can retrieve user's app-specific user id.
My first thought was to write an API that the phone could call out to which would accept parameters such as the Facebook or twitter userId. I would query my database and find their internal user id and return it to the phone.
This would work fine, but its completely insecure. Anyone could hit that same API with a Facebook user id and the API would just return the internal ID (and any other data needed by the app) without knowing if the request is authorized.
This is my first mobile app, so I am a little unsure of the correct way to implement security on my API.
794
App attestation is one way to ensure that only genuine, tamper-free versions of your mobile app can access your API. There are various ways to implement app attestation, but one common approach is to make use of a cryptographic signature of your app that can be verified.
One of the most straightforward ways to secure these APIs is to implement authentication mechanisms that control their exposure, mainly through user credentials and encrypted access codes.
Like any software, APIs can be compromised and your data can be stolen. Since APIs serve as conduits that reveal applications for third-party integration, they are susceptible to attacks.
Broken User Authentication Another common API vulnerability is the use of illegitimate tokens to gain access to endpoints. Authentication systems themselves may be compromised, or expose an API key accidentally. Attacks can exploit such authentication tokens to gain access.
Finally, for your problem, if there is new progress, please let me know, thanks!
113
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
