移动iOS / Android上的Facebook / Twitter oauth，如何在应用程序端保护我的App_id和机密？

Question

In order to initiate oauth on the mobile, I have to provide the application keys, which are very sensitive and must not be revealed, How do I protect them? It's possible to hardcode it in the app, or to acquire it every time they are needed using a web service call, in any case, it looks like it is not well protected. Any suggestions?

Answer 1

In order to initiate oauth on the mobile, I have to provide the application keys.

You don't, you can use TWRequest (iOS 5) or SLRequest (iOS 6+) to perform OAuth requests.

If, for some reason, you want to use your own consumer keys (in order to access direct messages for instance) then you can implement the reverse auth flow.

You keep your consumer secret on your own server. Your server will request some tokens that will then be retrieved from your app and sent again through TWRequest / SLRequest. The response will be tokens valid for the user and your app , and you will be able to access the user's account from your server.

You can implement reverse auth by yourself or use the STTwitter library to do so.

I don't know if the following scheme is enlightening or not but it can help.