SlideShare una empresa de Scribd logo
1 de 10
OAUTH AUTHORIZATION
IN CLIENT-SERVER APPLICATIONS
          for iPhone / Android

      presentation by Taras Filatov
                    for
            Londroid meetup




                 www.mob1serv.com
             ©   Injoit and YAS, 2010
History
http://www.injoit.com/blog/2009/02/20/an-idea-for-saving-game-scores-online-for-iphone-
                                        apps/
OAuth
http://oauth.net/                          http://oauth.net/code/




http://code.google.com/p/oauth-signpost/

                         http://groups.google.com/group/oauth
iGetScoresand Android
online high scores API for iPhone

           http://www.igetscores.com/

           http://www.mob1serv.com/high-scores/
iGetScores
              OAuth nonce / time zones problem

http://www.injoit.com/blog/2009/06/26/getting-to-know-oauth/




                                     different time zones of players
                                     caused OAuth to stop working
Mob1serv
                           http://www.mob1serv.com/
•   Mob1serv is a SaaS suite providing a
    single solution to all typical server side
    tasks faced by mobile developers

•   One library, 5 min installation

•   Huge added value for end users:
    Online High Scores, IM/PM (direct
    messaging), Events Notification, GPS
    location tracking, Banners Manager,
                                                 http://www.mob1serv.com/help/quick-install/
    Facebook / Twitter / Google integration,
    Files storage etc

•   Serious business class service, no
    annoying ads or 3rd party advertisement
OAuth in Mob1serv
           http://www.mob1serv.com/oauth-contracter/

PLATFORMS

1st version: client: iPhone; server: PHP

NOW: client: iPhone / Android library; server: Ruby on Rails



IDENTIFICATION
1st version: UDID

NOW: 1) login 2) login+password 3) iPhone UDID / Android ID
OAuth in Mob1serv
              http://www.mob1serv.com/oauth-contracter/
 AUTHENTICATION EVOLUTION

 1st version: Standard OAuth ‘3-legged’ scheme
* 2 keys: Consumer and Secret
* Application works with server through HTTP requests
(data is NOT encrypted, it is only signed with HMAC-SHA
hash)
* App sends Consumer Key and Consumer Secret to receive
Access Token and Access Token Secret
* App sends Consumer Key, Consumer Secret, Access Token,


NOW: improved scheme (simplified but more secure)
* Consumer Key replaced with Token
* All requests are signed with merged parameters hash +
Consumer Secret but Consumer Secret is NEVER
transmitted openly to avoid Man-in-the-middle attacks
* Timestamp and nonce are still used to avoid Replay attacks
OAuth Contracter
             http://www.mob1serv.com/oauth-contracter/


Modules (API wrappers):
* Twitter
* Facebook
* Yahoo
                                                     SERVICE
                                                     (Twitter /
                   APP       OAuth Contracter        Facebook /
                                                      Yahoo)
Libraries:
* iPhone
* Android
Thank you!

Contacts
•   e-mail: taras@injoit.com

•   www: www.injoit.com

•   www: www.mob1serv.com

•   twitter: INJOIT and MOB1SERV

Más contenido relacionado

Último

Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
WSO2
 

Último (20)

WSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering DevelopersWSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering Developers
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWEREMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
 
Understanding the FAA Part 107 License ..
Understanding the FAA Part 107 License ..Understanding the FAA Part 107 License ..
Understanding the FAA Part 107 License ..
 
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
 
[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
Exploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusExploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with Milvus
 

Destacado

How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
ThinkNow
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
Kurio // The Social Media Age(ncy)
 

Destacado (20)

Everything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTEverything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPT
 
Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
 

OAuth in mob1serv: Android point of view

  • 1. OAUTH AUTHORIZATION IN CLIENT-SERVER APPLICATIONS for iPhone / Android presentation by Taras Filatov for Londroid meetup www.mob1serv.com © Injoit and YAS, 2010
  • 3. OAuth http://oauth.net/ http://oauth.net/code/ http://code.google.com/p/oauth-signpost/ http://groups.google.com/group/oauth
  • 4. iGetScoresand Android online high scores API for iPhone http://www.igetscores.com/ http://www.mob1serv.com/high-scores/
  • 5. iGetScores OAuth nonce / time zones problem http://www.injoit.com/blog/2009/06/26/getting-to-know-oauth/ different time zones of players caused OAuth to stop working
  • 6. Mob1serv http://www.mob1serv.com/ • Mob1serv is a SaaS suite providing a single solution to all typical server side tasks faced by mobile developers • One library, 5 min installation • Huge added value for end users: Online High Scores, IM/PM (direct messaging), Events Notification, GPS location tracking, Banners Manager, http://www.mob1serv.com/help/quick-install/ Facebook / Twitter / Google integration, Files storage etc • Serious business class service, no annoying ads or 3rd party advertisement
  • 7. OAuth in Mob1serv http://www.mob1serv.com/oauth-contracter/ PLATFORMS 1st version: client: iPhone; server: PHP NOW: client: iPhone / Android library; server: Ruby on Rails IDENTIFICATION 1st version: UDID NOW: 1) login 2) login+password 3) iPhone UDID / Android ID
  • 8. OAuth in Mob1serv http://www.mob1serv.com/oauth-contracter/ AUTHENTICATION EVOLUTION 1st version: Standard OAuth ‘3-legged’ scheme * 2 keys: Consumer and Secret * Application works with server through HTTP requests (data is NOT encrypted, it is only signed with HMAC-SHA hash) * App sends Consumer Key and Consumer Secret to receive Access Token and Access Token Secret * App sends Consumer Key, Consumer Secret, Access Token, NOW: improved scheme (simplified but more secure) * Consumer Key replaced with Token * All requests are signed with merged parameters hash + Consumer Secret but Consumer Secret is NEVER transmitted openly to avoid Man-in-the-middle attacks * Timestamp and nonce are still used to avoid Replay attacks
  • 9. OAuth Contracter http://www.mob1serv.com/oauth-contracter/ Modules (API wrappers): * Twitter * Facebook * Yahoo SERVICE (Twitter / APP OAuth Contracter Facebook / Yahoo) Libraries: * iPhone * Android
  • 10. Thank you! Contacts • e-mail: taras@injoit.com • www: www.injoit.com • www: www.mob1serv.com • twitter: INJOIT and MOB1SERV

Notas del editor