OAuth Done Right: Secure Authentication for Androi…
summary
Practical checklist for Android OAuth: use PKCE with the authorization code flow and external user agents (Chrome Custom Tabs) per RFC 8252; treat access tokens as short‑lived (~15–60 minutes) and refresh tokens as long‑lived (months to years — one case had 60 years); stop relying on Google’s EncryptedSharedPreferences (it’s deprecated) and prefer platform storage or community forks if you must encrypt; use AppAuth or Credential Manager; implement step‑up auth for high‑risk actions (example: reauth before a phone purchase) and log unified error mappings across platforms.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 2:11OAuth for mobile security
- 5:41Actors and auth vs authz
- 8:49OAuth tokens and JWT
- 10:13ID, access, refresh tokens
- 14:53OAuth 2.0 grant types
- 17:05Authorization code flow
- 18:53Device flow
- 21:48PKCE best practices
- 23:34External browser login
- 26:42Token storage on Android
- 29:14Step-up authentication
- 32:02Google’s credential manager
- 33:05OAuth libraries
- 34:29OAuth 2.1
- 34:51Q&A
related talks
27mSecurity Issues In OAuth/OIDC Implementations
52mAuthentication, Authorization, and You...
46mA More Secure World for Android Apps
42mA MORE SECURE WORLD FOR ANDROID APPS
20mHow to best authenticate with non-Google identities
38mThe Present and Future of Standardized Authentication Specifications You Can Experience on Android/Chrome
30mBest practices for using sign-un for Android apps
44mThe Art of Authentication for Web Apps