Implementing JWT authentication in Android using Account Manager

Question

I’m implementing a Android app and that must contain a user login. To do this I create my own authenticator with the purpose of login only once. Then AccountManager can request access tokens, so the application is not handling passwords directly. The AccountManager stores the user account and the token.

I’m using JWT (Json Web Token) to authenticate the user in my REST API.

I wonder whether this flow is correct or there is a better approach to do this in Android.

Here is the flow I am currently using:

1. The user enter user and passwords in the login screen at first time.

2. I make a request to server to retrieve a valid token (JWT) that is stored in the Account Manager.

3. Subsequent requests use the received access token until it is expires (1 hour) to retrieve content from the API.

4. After the token is expired, it can be refreshed up to two weeks after issue time. From this moment, user credentials are needed to retrieve a new token.

Is this process the correct way to work with the token, and refreshing it? Is the process safe? Are there other options?

Considering this flow is not using a “refresh token” to generate a new one but the access token, what would be the best usage of the Android Account Manager? What other tools should I use? Is it recommended an Oauth2 implementation along JWT in order to implement a “refresh token”?

Cheers!

Answer 1

I can tell, you are on the right road of using JSON Web Tokens and reproducing it.

but the safety you mentioned is all about encrypting the token you retrieved and then saving it in Account Manager (also the same with user credentials) with some encryption method of your choice like AES or RSA and then decrypt if when you wish to use. Also using a server-generated secret key with a secret algorithm would kill the shot for any hacker.

As you understand everyone with a root access can get hands on the saved credentials database and use it.

Using these tricks will lower the need of using Oauth 2.0 which involves a refresh token.

hope it helps