Bdtjtk

My current Android application requires users to login with Username and Password.

The Android application calls a REST web service for user login and I do not want to transmit the password as cleartext.

How do I go about securing my users passwords so that the server side can Identify/authenticate each user?

I am currently trying to employ the Jasypt library as follows:-

ConfigurablePasswordEncryptor passwordEncryptor = new ConfigurablePasswordEncryptor();

passwordEncryptor.setAlgorithm("SHA-1");

passwordEncryptor.setPlainDigest(true);

String encryptedPassword = passwordEncryptor.encryptPassword(userPassword);

...

if (passwordEncryptor.checkPassword(inputPassword, encryptedPassword)) {

  // correct!

} else {

  // bad login!

}

however my server side is written in .NET and as far as I understand the Jasypt documentation the password encryptors employ a random salt.

How can I have my server side code match the hashed users password I am sending it?

All my webservices have HTTPS endpoints, does this guarantee that no one can "see" my users passwords "in flight" when exchanging for an access token?

If you use Https(TLS) then your password is inaccessible to anyone intercepting the network.

You should hash the password string in your server side code not in the client

You have to be careful about what you do. Consider implementing a common two-factor key-sharing algorithm, such as TOTP.

A pretty uncommon, but really good practice, is the client-side hashing. This of course doesn't stop the hacker from logging in to the user's account, but it stops them from obtaining the potentially reused plain-text password.

I recommend that changing E-mail and password are done under the reset password formula, such that E-mail/SMS confirmation is required.
And finally, as you do it is extremely important that the connection, where the login happens is secure, for example, https/tls.

There are couple of things you need to consider while implementing authentication and authorization between client(Mobile app) and server.
Firstly, what authentication and authorization mechanism does your server have to request api endpoints? (Is it Two-Factor Auth? Is it bearer token (grant-type username and password) based? Is it bearer token (grant-type access-token) based?

Secondly, as you have mentioned server programming is .Net based but can you be more specific whether your service layer (Api ) written in WebApi 2 or OData ?

Finally, does your server allow to communicate with or without SSH i.e. HTTP vs HTTPS? If it's with SSH then its okay to transfer user credentials i.e. username and password over othewise it will be never secured to transer credentials over HTTP.

Then only it comes at your end i.e. in Android Mobile App to impelement the authentication and authorization mechanism as per server requirement to communicate with api endpoints.

For example, my server requires to implement token-based authentication (bearer token and grant-type password) to make every server request (GET, POST, DELETE, PUT) and I have implemented using retrofit client as like :

 public Retrofit getRetrofitClient() {



    // first add the authorization header

    OkHttpClient mOkClient = new OkHttpClient.Builder().addInterceptor(new Interceptor() {

        @Override

        public Response intercept(Chain chain) throws IOException {

            Request newRequest  = chain.request().newBuilder()

                    .addHeader("Authorization", "XXXXXXXXXXXX")

                    .build();

            return chain.proceed(newRequest);

        }

    }).build();



    if (retrofit==null) {

        retrofit = new Retrofit.Builder()

                .client(mOkClient)

                .baseUrl(BASE_URL)

                .addConverterFactory(GsonConverterFactory.create())

                .addCallAdapterFactory(RxJava2CallAdapterFactory.createWithScheduler(Schedulers.io()))

                .build();

    }

    return retrofit;

}

and my service is

  public interface LoginService {



    @POST("/api/token")

    @FormUrlEncoded

    Call<TokenModel> getToken(@Field("username") String username,

                              @Field("password") String password,

                              @Field("grant_type") String grantType);



}

Now I can use this token in every request to commuicate with server. I don't need to transfer username and password over public internet rather I use just token and it has 24 hours expiration ( as server has implemented this token expiration date).

Hope it helps you to understand the authenticaiton and authorization mechanism between cleint(Android Mobile App) and server.