31

I'm trying to work out the best way to handle user authentication for my mobile application (iOS & Android) and API (PHP).

From what I've researched the options are:

Basic auth over HTTPS - Check username/password of the user for every request.

Sessions - Send a session ID with each request; server maintains state. So app sends username/password and server checks for a logged in user on subsequent requests, just like my website does.

API tokens - Mobile app sends username/password and receives a token back, then appends this to subsequent requests. Token stored in DB and checked on each request.

I'm guessing my explanation of API tokens is incorrect as they seem identical to sessions because I store session ID's in the DB.

  1. Could my explanation of API tokens be corrected. What are they for? How do they differ to session ID's?
  2. What are the advantages of API tokens?
  3. Is oAuth (if we were to simplify its uses) just a protocol for creating "API tokens"?

1 Answer 1

32

I'm no expert but I'll give you a couple of cents I've picked up:

1) API Tokens is a bit of a general term. Usually an API token is a unique identifier of an application requesting access to your service. Your service would generate an API token for the application to use when requesting your service. You can then match the token they provide to the one you store in order to authenticate.

A session id can be used but its purpose is different to the API token. The session id is not a form of authentication but rather a result of authorisation. Typically a session is established once a user has been authorised to use a resource (such as your service). Therefore a session id is created when a user is granted access to a resource. An API token is the form of authentication similar to a username/password.

2) API tokens are a replacement to sending some username/password combination over HTTP which is not secure. However the problem still exists that someone could take and use the API token instead.

3) In a way yes. It's a method for keeping API tokens "fresh". Instead of passing around the same API token you request an access token when you want to use a service. The OAuth 2.0 steps are as follows:
   a) Request sent to service with credentials of some kind
   b) Successful response returns a code
   c) Another request to service is made with the code
   d) Successful response returns the access token for signing each API request from then until finish.

A lot of the bigger service providers use OAuth 2.0 at the moment. It's not a perfect solution but it's probably the most secure, wide-spread, API security method used at the moment.

12
  • Could you elaborate on "The session id is not a form of authentication but rather a result of authorisation."?
    – paul
    Jul 22, 2013 at 11:19
  • Updated my answer, in short - The session id isn't a form of authentication, the API token is. Jul 22, 2013 at 12:31
  • Are you saying an API key just identifies requests coming from my app and is nothing to do with a user logging in via the app? Because from what I've read my API should be stateless and not use sessions.
    – paul
    Jul 22, 2013 at 12:47
  • That's correct. The API token is passed in each request to the service from the app, so that the service knows who is requesting the resource. I don't recommend using sessions either, you asked ;) Jul 22, 2013 at 12:49
  • 1
    yes I'm confused! Ok forgetting about where the requests are coming from for now; Android app opens and requests a username and password from the User and sends them using basic HTTP auth over SSL, subsequent requests also send the username and password. That's one method. So where does oAuth/tokens come into this if I didn't want to opt for the above basic auth method?
    – paul
    Jul 22, 2013 at 13:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.