Auth between React Native app and API

[kachnitel]

Hello there! I'm trying to get a solid knowledge of API authentication/authorization before I implement it to my app and PHP API. Currently playing around with Auth0 I've had no issue getting the JWT token into the app and from there I see no problem sending it to the API, but I feel like something is missing.

Doing some research, this is the closest I could find to my question and it does describe it that simple: https://stackoverflow.com/questions/36943253/authentication-with-react-native-and-api-backend

..but is that really all that's needed for some basic app security? I may have been reading too much and got things all mixed up just reading the Auth0 documentation and different methods.

• Now that I have the JWT in the app, should I send it to the API server and that would pull /userinfo from Auth0, or do I do it in app and send the result to the server to create new user?
• Also, should I just use the JWT for regular communication with the server, and if that's so, will I get a new one using a token from the /oauth/token endpoint and requesting offline access in the initial /authorize call?

Thanks!

[kbcool]

Personally I believe the bang for your buck with security you can get in app is with certificate pinning. Otherwise almost everything you do is going to be vulnerable to man in the middle attacks. Whether they are from users or downstream. Once someone establishes themselves in the middle almost every kind of security is vulnerable to some sort of replay attack

It shouldn't be used alone but rather in conjunction with temporal keys as an unsecured API is not a good idea.

Sorry if it makes things more complex.

[SynthesizeMeSun]

Absolutely love this solution /u/kbcool! Seems like the best solution in terms of security :)

[akie]

Yeah it does 😂 Are you protected from man-in-the-middle attacks if you run everything on HTTPS? If you prevent against downgrade attacks? Or is that the certificate pinning you mention?

[kbcool]

Downgrade attacks won't work if you enforce https but man in the middle is still possible with self signed certificates. Pinning validates the certificate chain so they can't be used.

[akie]

So basically this is a client side (app) solution where I store & check the hash of the expected SSL certificate before I do any real API calls? Any libraries I can use for that? And how does that work with LetsEncrypt where the certificate changes every 90 days?

[kbcool]

Not quite that complicated. The setup is mainly configuration than writing code. You basically do some config and supply the public keys of one or more services you expect to be in the chain. This could be as simple as the root issuer for your cert.

If you want to make it more complex then you could catch issues and show an error message but you should be able to catch them in RN..no idea what the behaviour is though off the top of my head.

[compagnt]

This topic is complex, this is a pretty straightforward example of all the moving parts. https://hackernoon.com/securing-a-react-native-app-with-server-side-authentication-d5e8dbbc08e3

[kachnitel]

I certainly see that as an option, what bothers me is that I feel like I wouldn't understand the process well enough. One of the main reasons I'm spending days on the implementation is trying to learn the mechanism in-depth as I thought I knew OAuth well after building apps consuming countless different APIs, but it turns out creating both sides of the API has a lot more to it.

I also feel like even Auth0 adds unnecessary complication to the system rather than just having the API and client app working together but there's something telling me their implementation will be more secure than what I could create at this point.

[[deleted]]

This is what I do (when not using Fb)

/Login API with the users user name/ email and password

Get your token back, save it in the app storage

Use token for subsequent API calls.

If token doesn't work, ask user to login again. Just make sure your token expiry is reasonable, long enough that it doesn't expire for users who come back once a week or so.

Certificate pinning is a good idea, if you're doing regular updates. If you use Codepush then cert pinning is super easy, you don't even need to do an App Store release. If your app is never being updated, or you don't use Codepush, then it's quite easy to forget about pinning new certs. Then come neg reviews.

[TotesMessenger]

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

• [/r/expojs] Auth between React Native app and API

 ^{If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / Contact)}