Geek asks and answers

How to authenticate a trusted application using OAUTH 2

I am developing the OAUTH 2 REST API for the website I am working on. We have an official native mobile application that uses this API and plans to open the API to third-party developers. Our native mobile application will have more permissions than third-party applications. I do this by setting permissions based on client id or application id. I use password grant typefor the official application and implicit grant typefor third-party applications.

But the problem is that, since we do not use client_secret, in any case, a third party can get elevated permissions by somehow stealing our official one client_idand using it to gain access to the elevated permissions in the API, which is exclusive for the official application.

Is there any way to prevent this? How does the official Facebook or Twitter app do it?

+5
source share
1 answer

you can use tokens, which are hash of this information ( client_id, Official app, day...) for applications

"Day" to receive a new token every day, which minimizes the risky

(client_id, 3rd party,...) , API

Api SSL, , , / .

+1

More articles:


All Articles