Appengine endpoint authentication with android client without using google account

Question

I have an android app which backs up data on google appengine using cloud endpoints.

I do not use a google account in the user's device to uniquely identify the user. I use a different username (which user chooses initially when signing up) to identify the user.

I tried to use OAuth authentication to authenticate users who make endpoint API calls but it seems that I must use the google account on the android device when calling endpoint API calls, for OAuth authentication to work.

So I decided to add username and password as arguments to all the authentication required endpoint API calls. I store username and password as a SharedPreference when the user signs up or logs in. Then, I use this username and password to make authentication required API calls.

Is there any security issues in this approach? If so, is there any better method?

Answer 1

The one issue I see security wise is:

I decided to add username and password as arguments to all the authentication required endpoint API calls

If you do that, then the username and password will be part of the URL request. Instead, make your API method(s) POST and create a wrapper class that uses a simple POJO that has username and password properties with getter and setters and pass that class in as the argument.

FYI You can only pass in one class as an argument into Cloud Endpoints API methods, so if you have multiple class/entities you want to pass in you will have to create another wrapper class that just has those classes/entities as properties with getters/setters.

Also, make sure you hash/encrypt user passwords when they are created so you are not passing around plain text passwords. There is lots of info out there on how to do that in Java if you google it.