Hi, I am fullstack developer, mainly focused on mobile native applications and API for the server side in order to expose resource to the client, as far as I am developing native mobile clients, there is no way to use web based authentication methods like sessions. REST API is stateless so the most proper and widely used method to do this is to use token authentication.
I have read a lot about different possible ways for securing API for instance E-commerce applications like online stores, where it is important to secure connection.
I know a lot of different ways to secure API. but all of them seem unsecure for me.
Let me explain, what I cannot understand.
Why don't use password and login ?
By default in many web apps, you can do anything using your password and login( change password , buy ...) So this is the most sensitive data that should be secured.
And for example storing pass + login directly on the mobile device is bad idea as far as it can be easily stolen by the malicious applications for the rooted devices.
And send pasw + login each time you need to access secured resources is really bad idea.
So the token auth came to make this communication more secure and flexible.
I will not take into considiration OAuth auth, because it requires separate server where again you need to enter pass + login in order to provide some permissions to the some app.
Lets consider some kinds of token auth.
-
Simple toke generated after the first login with pass + login and stored somewhere indicating that user is logged in, this something similiar to sessions, but anyway user should send token each request ( in case of sessions browser does this work sending cookies).
-
Second type is JWT toke which is becomes more popular now. It is great idea to store all information inside token. First time I was wondering, how server can identify user for the second request where token only passed and it is not stored on the server in some table. But than I got it, because token is signed by some secret and each token contains some unique information (no collisions of hash) server can encrypt it by itself and check if it matches the passed by the user. Great idea which is good for REST as far as it is stateless.
But what is my question is How secure token auth is without https.
Lets consider example, attacker has stolen token, so what is the difference between stolen pass and token ? Of course mostly token doesn't allow you to change the password and restrict other actions with you account, but anyway attacker has stolen token and it can access private information now.
It is okay if token allows only to see some information ,but what if token allows you to make purchase in online store, transfer money ? Attacker can do anything now, make orders .... Of course you can request login + pass before such actions like purchase, but user won't like this.
Surely, token has expire time and will be expired, but if attacker has token he can request refresh token or just do bad stuff while token is valid.
In this case token seems useless Of course with HTTPS it is much more secure, but using https you can send sensitive data without such mechanism like token auth, just send pass and login. If attacker brokes secure channel nothing will help you in this case ?
Sorry, maybe I have described not clear enough, but the main question is how to token auth will work if attacker obtaines token ?
Thanks for any help in advance.
