CODEWITHSUNDEEP
securityauthenticationpasswordsbasic-authentication
Jason94
Jason94

Reputation: 13620

How can I secure online API for my app?

I'm creating an app for Windows Phone and Android. So right now Im building a webapi they both can use, but I want to secure it som non other then my applications can use it. How do I go about it? No one else then my apps is going to access these APIs.

I don't want to implement OAuth.

I've got two scenarios that I'm thinking of:

First (I store username and hashed password on the client):

Second (I store accesstoken on the client):

The problem as I see the second approach is that the server sends accesstoken to the client, if anyone where to get this they would have the access of the user.

How is it done in the real world?

Upvotes: 1

Views: 81

Answers (1)

Fabian Schmengler
Fabian Schmengler

Reputation: 24576

You could use a slight modification of First:

  • store username and password on client
  • basic-auth over https

Storing a password hash on the client, then sending the hash and comparing it with the hash in the database is equivalent to storing a plain text password in the database because the hash becomes the password. So, your apps should authenticate with a username and password like any human user would do.

But your concerns for the second approach apply too. If somebody intercepts the message, he has your credentials.

A more secure solution is HMAC authentication (now we're talking "real world").

  • a user has a secret key that is stored on server and client
  • each request gets canonicalized (transformed into a distinct string, which contains the request method, URI, parameters and timestamp)
  • the canonicalized request gets hashed with HMAC using the secret key, hash and user id are passed in the HTTP Authorization header
  • on the server, a hash is generated using the same algorithm (with timestamp from the HTTP Date header) and compared with the sent hash.
  • if the results are equal, the request is authenticated

An example is the Amazon S3 REST API - the linked documentation is also a good example how to implement it for your own API.

Upvotes: 1

Related Questions