2

I am building an API for my rails app. Through that API I will log users in and allow them to interact with their data.

On top of that users authentication, I will also like to make sure only my iOS app has access to the API, and eventually my own web app.

I want to make sure no one else will be using the API, so on top of the user authentication, I will like to protect my API with a token for each of my apps.

How do you usually solve this problem? Would I have to pass that token over on each call in order to authenticate that the call is coming from a valid client and identify which client it is (web vs iOS).

I will very much appreciate any pointers or if you know of an article explaining how to deal with this.

2
  • check out jtw Jul 15, 2016 at 6:54
  • thanks @JigneshAgola, I am using jwt to authenticate a user. Probably I am just confusing concepts, but what I would like to do o top of authenticating users, is to authorize only my app to make requests agains the API, and preventing someone else to build an app agains my API. Jul 15, 2016 at 14:44

1 Answer 1

0

As you are already using jwt's to authenticate your user, why not just use the functionality of jwt to include additional information in the token, in this instance some form of hashed string that you can verify server side if it is a valid "client id". On each request you could refresh the string.

Kind of dual authentication in each request. the user and the client.

3
  • I like that idea @stewart Jul 22, 2016 at 5:21
  • How would it boot up? What would discriminate my app from another app or a Postman request, based only on the "client id" that is passed? The "client id" would be sent from the client to the server, so how could an attacker not easily find out that "client id" and use it in its own requests?
    – Simone
    Jun 25, 2019 at 8:11
  • @Simone I know this is a long time ago, but here the explanation: oauth.com/oauth2-servers/client-registration/client-id-secret
    – DAG
    Feb 28, 2020 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.