Geek Answers Handbook

Integration of oauth2 with a mobile application (iOS / Android)

I need to integrate OAuth2 into my own iOS and Android application. I studied OAuth2 and mobile applications and found this documentation - Google APIs - Using OAuth 2.0 for installed applications

The above documentation mainly describes how to use the Goolge OAuth 2.0 endpoint in mobile applications.

This is what the document says -

  • When registering an application, you indicate that the application is an installed application. This results in a different value for the redirect_uri parameter.
  • Client_id and client_secret obtained during registration are embedded in the source code of your application. In this context, client_secret is not explicitly considered a secret.
  • The authorization code can be returned to your application in the browser header line or in http://localhost in the request line.

Let's say a user has 2 applications installed on their smartphone.

App1 - A legitimate application using the Google OAuth2.0 endpoint

App2 - malicious application

In fact, I'm not sure if the above integration / consumption methodology of the OAuth2.0 endpoint inside the native mobile application is unsafe or I am missing something. Here are my questions -

  • The redirect_uri URL can be the URL http://localhost and can contain any port number. The port number is not part of the initial API configuration and, therefore, can be any valid port number. In addition, client_id (in any case should not be a secret) and client_secret are not really secret, as they are embedded in the source code of the mobile application.

Using the above conditions, the following may not be possible:

  • User launches App2
  • App2 redirects the user to the Google OAuth2.0 endpoint, however, in the App2 request, it includes the client_id for App1 and includes the local port number on which App2 is listening.
  • When a user is redirected and authenticated at the Google OAuth2.0 endpoint, Google tells the user that "App1 (legitimate application) requests access to the Google API / data on behalf of the user", which looks like a phishing attack, because the user can click "yes "thinking that App1 is requesting access.
  • Google OAuth2.0 will then issue an authorization code in App2, and App2 will be able to make the next request, including App1 client_id and client_secret, and get access_token and refresh_token and continue to access user data from Google.
  • The redirect_uri parameter can also be a-urn: ietf: wg: oauth: 2.0: oob, which means -

This value signals to the Google authorization server that the authorization code should be returned in the browser title bar. This is useful when the client cannot listen on the HTTP port without significant client configuration. Windows applications have this feature.

When this value is used, your application may feel that the page is loaded and the title of the HTML page contains an authorization code. Then your application closes the browser window if you want the user to never see the page containing the authorization code. The mechanism for this varies from platform to platform.

The above means that the authorization code is returned in the title bar of the browser window.

My question is: can App2 also understand that the page loaded and captured the authorization code, and then uses it (before App1) along with client_id and client_secret to get access_token and refresh_token. Is the browser instance global and any application can control it, and the above attack scenario is valid or is the browser instance somehow application specific, so that only App1 can track / track changes?

Did I understand correctly or did I miss something? Are there any mitigating measures to mitigate the aforementioned threats? OR Are the above risks valid, but accepted, given that we are on a mobile OS platform?

What is the safe way to use OAuth2.0 in mobile applications? - Display the authorization code on the browser page and enter the user manually in the application? And in this case, a private browser instance, so that another application can’t control it and get an authorization code before the user types it into a legitimate app?

Any help is appreciated

Thanks and respect,

+4
source share
2 answers

In my experience, I have found that there are very few libraries that actually support retrieving authorization code in a clean way.

On most mobile platforms, you can “listen” for URLS redirection (is it http or some kind of user scheme)

For example, on Android, you can easily create activity to receive an access token (based on the authorization code that it receives through the redirect URL.

  <activity android:name=".OAuthAccessTokenActivity" android:launchMode="singleTask">> <intent-filter> <action android:name="android.intent.action.VIEW" /> <category android:name="android.intent.category.DEFAULT" /> <category android:name="android.intent.category.BROWSABLE" /> <data android:scheme="http" android:host="localhost" /> </intent-filter> </activity>

In this case

 http://localhost

On mobile platforms such as Android, this seems like a logical task.

The same thing can be done in iOS, but the Google OAuth library for iOS takes a page title approach, if I remember correctly.

Technically, there is no difference between the two threads. The only difference is the syntax of the redirect URL, which creates a different location for the authorization code.

From a security point of view, only an authorization code is useless without the secrecy of the OAuth2 client.

Having a custom authorization code is something I'm not used to seeing in Oauth2 streams, but it is possible. If in doubt, he will add something safe. IMHO this will only upset the user.

This does not mean that there are various ways to obtain and process an authorization code (automatic code capture through redirection using local or user-defined URI schemes or manual delivery)

0
source

Not a direct answer to this question, but for people who come here like me and get an outdated answer. Probably the best place to start is here: Google published their OAuth Java libraries and Scribe is ready for Java.

0
source

More articles:


All Articles