Let's say that my
Rest api is secured using
OAuth 2. Let's say my client is a
mobile App. Let's say that i have an
@Post /increasePoints host:https://www.example.com/increasePoints amout=10
Now Using this api call, one should have a valid
Access Token. from my app i have control when to call this function so there is no problem. but Let's say the authenticated user get a hold of the
access token. how can i stop him from posting to this api using his
Few options that i thought of:
- sign each call with a special header.
- use client_authentication with scope points - i've just read about this type of authentication but the user can get the
access tokenwith same ease for what i understand.