7

Is there any reason why I shouldn't use cookies/sessions for native mobile applications, usually used by browsers, to authenticate with my server and for subsequent API calls?

Clarification: It seems the de-facto method of authentication on mobile clients is token based systems like OAuth/XAuth. Why don't traditional browser methods suffice?

Karan
  • 1,636
  • 4
  • 19
  • 35

1 Answers1

2

This depends on your application (your threat scenario to be more exact).

Some of the most common threats are - eavesdropping (-> should encrypt) - man in the middle (-> must authenticate other party) - ...what are yours? (how secure is your cookie store,....)

A cookie at first only holds a token as proof that sometime you have successfully made an authentication. If the cookie is valid long enough or transport not encrypted, there is a good chance that someone someday will find out...

In addition you must take into account what additional security measures are in place, at first and most important SSL.

What is your authentication method (what credential does a client need to logon)? Do you have the possibility to work with authentication based on PPK infrastructure or is the communication "ad-hoc"?

EDIT

Wrt. to OpenAuth: as far as i understood the protocol its main concern is authentication delegation. A scenario where you authorize an agent to do some very specific task on behalf of another identity. This way you dont scatter your credentials all over the web. If you have OpenAuth in place, a client can use the protocol directly, too. So why bother adding another. But OpenAuth explicitly states that with a direct client scenario you again run into security issues as now the token is available on the device and must be protected accordingly (as you must do with your cookie).

mtraut
  • 4,720
  • 3
  • 24
  • 33
  • Thanks for your reply. Assuming we use secure transport (SSL) and a reasonable expiration policy, just as with web browsers, it seems you're saying this should be fine? We're sending just user/pass as is usually done with a POST request. – Karan Dec 30 '10 at 23:19
  • Also, not sure I understand what you mean by "ad-hoc". It seems the accepted way is to use something token based like OAuth/XAuth, but the purpose of this question is to see if cookies will suffice, and if not, why not? – Karan Dec 30 '10 at 23:21
  • If sesion / cookie stealing is not an issue for you, that seems fine. – mtraut Dec 31 '10 at 08:17
  • By "ad hoc" i mean a scenario very popular in mobile scenarios. Two devices that are not part of a "static" PPK infrastructure communicate (are paired). Without a trust base you must find some other means of authentication. – mtraut Dec 31 '10 at 08:21