2

I am creating a REST webserver where users can register with an Android app. To bypass the tedious process of filling out a registration form I am supporting the option to login with LinkedIn Android library.

The LinkedIn Android library offers a unique ID, identifying the user and an access token to talk with the API directly from the app.

I am currently storing the unique ID on my own server, so I know what profile should be loaded with the user that used Linkedin to sign up.

However, I cannot verify the validity of the access token or the id. How do I know that the user passing his ID is actually the real user and not someone else who is using the ID of a different user?

Isn't this a big security risk from LinkedIn?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.