Google+登录-具有一次性代码的安全性

Question

I am about to make an application and just want to make sure if this flow is good just incase there is a security issue.

• Client = Android
• Server = PHP

I am going to use the One-Time code flow to authenticate the client and the server.

First question, is there any issue sending this one time code over HTTP and not using HTTPS???

Once this is done, I will use the User Id supplied from Google+ to identify the user. This User ID from Google will be stored on my Database so I will be able to track the user.

As Android anyone can decompile the code they will be able to see how I am sending the request to my server. I will be sending a post request to a particular PHP page and in return the PHP page will return a JSON. In the PHP page I will need to run the code below to make sure the session is set up before passing the JSON back to my Android application?

if ($request->get('state') != ($app['session']->get('state'))) {
    return new Response('Invalid state parameter', 401);
}

Will this have any security implication? If there is a topic out there that answer this please point me to it as I could not find anything.

Answer 1

First answer - yes, there are a lot of risks sending it via HTTP instead of HTTPS. Although the code has a very limited lifetime, it still means that if someone wanted to intercept and use the code, they can easily do so before your server gets a hold of it. You might be able to get away with a self-signed certificate for what you're doing, but you really shouldn't be using HTTP in production.

The session management has a couple of possible implications, tho I'm not sure either are directly related to the Google+ sign-in. While this check does help ensure that the connection is from a legitimate session, rather than one that might have been run as part of an exploit. It isn't clear how you're doing session management, or what other activities might happen if this error comes across, but it might also be a good way that you're limiting resources used in case of a DoS attack.

Answer 2

请勿通过HTTP将一次性代码移至服务器。