CODEWITHSUNDEEP
androidrestsecurity
julamme
julamme

Reputation: 48

Correct way to implement anonymous authentication for an application?

I'm looking for your input in authentication to a rest api related question.

Now Imagine the following scenario: I have an android app that wants to use resources provided by an public API called MAIN_API (which i have no control over) that has a universal API key. The API key grants access to risky actions such as deleting records.

Now i want to allow the users of the app to have a very limited access to the API resources, but i want them to be able to use the application anonymously ( no credentials of their own).

I figured that the best way to approach this is to have another server that would contain the API-key and would provide the means for the limited access for the MAIN_API (for example PROXY_API would only call simple query endpoints). The actual mobile app would call this API. Call it PROXY_API for the purpose of explanation

Do you think this approach is enough to stop malicious usage of the MAIN_API? Do you think it would be beneficial to generate some sort of application credentials getting an access token from the PROXY_API?

Upvotes: 1

Views: 1517

Answers (1)

Daniel Cerecedo
Daniel Cerecedo

Reputation: 6207

To provide basic authentication to a web service is quite simple and will depend on the technology stack you are using on the server.

I'd recommend that if you need to both grant users and client applications access to resources to use an authorization mechanism such as OAuth. There are Opensource OAuth server implementations available. Though the OAuth server is a standalone component, securing your resource server to check authorization against the actual OAuth server may depend on your technology stack.

If you are not very knowledgeable about security, and want to control access to your API/Webapp using OAuth, I'd recommend you a service like Stormpath, Auth0 or 3Scale. They first two offer free accounts and can help you kick start your product.

Upvotes: 1

Related Questions