CODEWITHSUNDEEP
oauth-2.0authorization
James B
James B

Reputation: 9605

OAuth2: Which flow to use?

There appears to be four distinct flows in OAuth2, i.e. (link),

  1. Authorization Code Flow - used with server-side Applications
  2. Implicit - used with Mobile Apps or Web Applications (applications that run on the user's device)
  3. Resource Owner Password Credentials - used with trusted applications such as those owned by the service itself.
  4. Client Credentials - used with Applications API access.

If I'm developing a mobile application that will consume resources from its own API, i.e., the mobile app is developed by the same team developing the API, which of the four OAuth flows should I use and how?

Given my scenario, it sounds to me like option 3 is the way to go. If this is the case, would you adopt the following process:

  1. Release you mobile app with the ClientId and ClientSecret stored on it (deemed okay as the application is trusted).
  2. Ask the user to log into their account using cookie-based authentication (immediately deleting their username and password).
  3. Cache the hash of their username and password returned in the response of the cookie-based authentication.
  4. Use the cached username and password, along with the ClientId and ClientSecret, to request access and refresh tokens from the token endpoint of the OAuth server.

Doe this seem sensible? It would be good to know if I'm on the right track with the above thought process, or if I'm going something incredibly silly and ought to be doing this some other way.

Upvotes: 3

Views: 626

Answers (2)

Takahiko Kawasaki
Takahiko Kawasaki

Reputation: 19011

Resource Owner Password Credentials flow would be okay for your case.

BTW, it is difficult for a mobile application to keep its client secret confidential (RFC 6749, 2.1. Client Types, RFC 6749, 9. Native Applications). Therefore, in normal cases, a client secret should not be embedded in a mobile application. In other words, embedding a client secret is almost meaningless in terms of security.

Upvotes: 3

iandayman
iandayman

Reputation: 4467

2- Implicit - used with Mobile Apps or Web Applications (applications that run on the user's device)

If your application runs entirely on a mobile device then you are encouraged to use this flow as your mobile app can't be trusted to keep its client credentials secret.

Upvotes: 1

Related Questions