1

I currently have an app which basically runs two halves of an API - a restful API for the web app, and a synchronisation API for the native clients (all over SSL).

The web app is completely javascript based and is quite similar to the native clients anyway - except it currently does not work offline.

What I'm hoping to do is merge the fragmented APIs into a single restful API. The web app currently authenticates by issuing a cookie to the client whereas the native clients work using a custom HMAC access token implementation. Obviously a public/private key scenario for a javascript app is a little pointless.

I think the best solution would be to create an OAuth2 endpoint on the API (like Instagram, for example http://instagram.com/developer/authentication/) which is used by both the native apps and the web app.

My question is, in terms of security how does an implicit OAuth2 flow compare (storing the access token in local storage) to "secure" cookies? Presumably although SSL solves man in the middle attacks, the user could theoretically grab the access token from local storage and copy it to another machine?

1

The advantage of OAuth over a cookie is that it allows you to provide access to a third party service (like facebook does with their apps) without divulging the end user's credentials, and it allows the user to later revoke that access without needing to change their own credentials. If third parties are not involved, there is no essential difference in security.

If you provide the user some sort of access token, be it OAuth or a cookie, you have to assume that anyone providing that token is authorized. There's no way to stop a user from copying either one to another machine, and IP addresses change all the time on the same machine.

What you can do is limit the damage an attacker can do if they happen to intercept one of those tokens. That means requiring they be periodically renewed, and tracking which tokens are currently valid in such a way that you can tell when a token has been maliciously copied, as in Improved Persistent Login Cookie Best Practice.

  • Okay but for a JavaScript web app, presumably using implicit OAuth would require a redirect, back to the app with the token in hash fragment of the URL? – Jamie Apr 24 '14 at 14:05
  • @Jamie sounds like you're on the right track.. check this page as a reference bshaffer.github.io/oauth2-server-php-docs – Erik Jul 2 '14 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.