ASP Identity OAuth. Should I use ValidateClientAuthentication () and Secret in the mobile app stream?

Question

I have a mobile application that accesses ASP WebAPI in the background.
I implemented token authentication (using the Taiseer guide ).

However, there is one concept that I cannot understand: CleintId and ClientSecret .

From what I understand, the client’s secret (along with the client identifier) ​​is intended to block access to the endpoint of my API, which creates tokens. Thus, the endpoint is protected from malicious users trying to push the API and try to get some information by calling it with various inputs.

Meaning, only clients that keep a secret can trigger an authentic stream. And in my case, I have only one client, which is a mobile application, and the secret is kept in a safe place (KeyChain for iOs). But I read that these key chains can be easily dumped and analyzed in secret.

So, I came to the conclusion that I can get rid of all the secret logic of the client, basically leaving ValidateClientAuthentication () empty:

public async override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context) { context.Validated(); return; } 

And this dose does not seem to me to be a security hole, but simply a thin layer in the stream that is now gone. Because, again, the client’s secret can be easily detected by any attacker who has a mobile device with the application installed, and as soon as he receives it, this level of security is useless.

Are these assumptions wrong?

Can I leave the ValidateClientAuthentication () method empty?

Answer 1

As you already found out, mobile applications cannot keep their credentials private, because they can be extracted from application binary files. Not to mention that requests can be easily intercepted using a proxy server and a traffic analyzer such as Fiddler or Wireshark.

Using an authorization code stream (1) or providing the credentials of a resource owner’s password, client authentication is not required if the client cannot safely store their credentials and, therefore, cannot be considered a “confidential” application (see http: // tools. ietf.org/html/rfc6749#section-4.1.3 and http://tools.ietf.org/html/rfc6749#section-4.3.2 ).

For non-sensitive applications, it is safe to call context.Validated() .

Personally, I try to avoid providing the password credentials of the resource owner as much as possible, as it clearly defeats the goal of OAuth2: confidentiality of your password and granting limited privileges. If your application is fully trusted, this should not be a problem.

---

• In practice, using an authorization code stream without forced client authentication is extremely rare, because in this case it is easier to use an implicit stream with mobile client applications, which offers a similar level of security in this case (not to mention that it avoids the second roundtrip to the endpoint marker).