CODEWITHSUNDEEP
mobilejwtadfsoauth-2.0
user1424660
user1424660

Reputation: 54

JWT + OAuth2 + ADFS 3.0 + Mobile + API

I’m building a mobile app and API secured with JWT tokens issued from ADFS 3.0. The mobile app is registered as an OAuth2 client with ADFS. I’m concerned someone could intercept the JWT token and use it to access the API maliciously.

My question is will this be enough to secure the API?

Upvotes: 0

Views: 580

Answers (1)

Andrei Dragotoniu
Andrei Dragotoniu

Reputation: 6335

the token is indeed sensitive but this is mitigated by a few factors.

  1. The token is passed in the Authentication Header. This is why you need to only pass it via an https call because the header gets encrypted at that point and is secure.

  2. The token is only valid for a while .... and you can set this value to whatever you want. I had them setup for 1 hour for example. Even if someone does get a token, they can only use it for that time after which it becomes invalid.

You will need to secure the method of generating the token as well. Keep the ClientID and ClientSecret safe. Don't pass them in a URL for example as that can get intercepted.

If you do all this you will be as safe as anyone can be on the internet.

One final point from me, some people like to store the tokens in a database. I would recommend against it. Keep them around in your client app, yes, in a secure way so you can reuse them until they expire, but don't use any traditional storage which can be stolen, hacked etc.

Upvotes: 2

Related Questions