My iOS app includes several API integrations that use OAuth2 authorization. I see lots of online recommendations not to store client id's, secrets or tokens on the device. However, it's not clear to me how much of this is applicable for OAuth2. For example, the clientId is a query parameter for the Authorization request. Therefore any user can easily intercept this with a proxy (e.g. Charles), so I don't see the benefit in hiding this value. My understanding is the most significant vulnerability with ios apps is another app attempting to capture redirects using your app's custom scheme. But if we use Proof Key for Code Exchange (PKCE), the malicious app can only intercept the Authorization Code, and they cannot exchange it for a token without the Code Verifier. So, what is the best practice for iOS apps using OAuth2?
1 Answers
OAuth for Native Apps recommends the AppAuth pattern, where these are a couple of key characteristics:
The app uses a form of the system browser (ASWebAuthenticationSession window) so that the app never has access to the user's credentials
Authorization Code Flow (PKCE) is used, as you indicate. You can strengthen this further by using an https:// callback URL rather than a custom scheme, though it is a little harder.
SOMETHING TO COMPARE AGAINST
Here are a few links of mine, with further details and samples you can run, which may give you some ideas for your own solution:
Related