Search code examples
securitymobileoauth-2.0

Ways for verify mobile application client on server

I'm looking for a way to design

Mobile APP <--> Server API which:

  • authorize user and app for work with server using OAuth2.0
  • validate on server, that it's legitimate application

Problem I face now: Application in Oauth2.0 terminology is a public clients: there is no way to secure any static information in application bundle - any one can extract such info and reuse it in fake application.

And if I add some additional method for register new instance of application on Server - there is nothing stop fake application from doing the same thing.

Is there ANY way to exchange data between Application and Server without involving REST API, or get verified information aboute calling application.

I know that answer is platform specific - I'm interesting in information on any platform as I can search analog for others.

Solution

  • For mobile apps use Authorization Code Flow (PKCE) which generates a runtime secret, so that there's no need for a fixed one to be deployed with the app.

    A rogue app can potentially use the Client Id and Redirect URI of your app, but one way to deal with that is to use Claimed HTTPS Scheme Based Redirects, as recommended in Financial Grade APIs / Native Apps.

    If interested in this approach, my blog has a couple of detailed examples: