移动应用程序：用户写入数据库如何确定他们可以（身份验证）？

Question

I think it's important to say that I don't have any experience in the technologies nominated below, I have some idea what is going on, I've googled a lot, but still - more I google more dumb I feel. :)

Making an app in Ionic 2, users of this app can read/write data about themself in DB.

I am using Wordpress as backend, actually users will change values in the table that was created by some Wordpress plugin.

First problem - I have no experience at all.
Second one - I must understand which user is knocking to the server. Because user can change only his own data in DB.

I've solved it by creating a script that checks GET request from app & that request has a param with user nickname, so I have turned this script to template and assignined it to the page. ( template was first thing that went to my mind, if you have better idea - please tell me how to do it better! ).

Well now I knew who it is, but I disliked that this so unsecure! Its only GET request with user name in it and changes to bring into DB. NOT GOOD. I've thought that I should send not only nickname but also some kind of a password, so I can check if the user is actually genuine user, well, you know.

But knowing nothing about security, didn't know where to start so I've started googling.

I've find out that there is 'Basic Authentication' - disliked it because password is verry simple to decode (base64) and you must send it with every request (not safe).

Then I thought about crypting pass with strong algorithm like bcrypt & then send it with the request. Disliked it too - because at the end you are always send a password even if strongly crypted.

Now I've started to look in the direction of Auth 1.0 (because saw that wordpress has a plugin for it, I know little about wp however).

But after all I am not so sure that I am doing things in the right way. I must finish many things, but I am stuck with this security issue and I don't know if it's my paranoia and there is simplier ways to accomplish what I want to do. Don't have much time, don't want to waste time anymore.

Please, someone who is pro in this stuff give me an advise how to do this thing in the right way! because I am going crazy with that stuff.

Answer 1

The best practice is to issue an access token from your server to your (or even third-party) client application by the following steps.

1. A user uses a client application.
2. The client application asks the user whether to use your service.
3. The user answers "yes".
4. The client application opens the authorization page of your service using a web browser. In other words, the client application makes an authorization request to your authorization server .
5. The authorization page explains to the user that the client application is requesting some permissions and asks the user whether to approve it or not.
6. The user inputs his/her ID and password into the login form in the authorization page and then presses the "approve" button.
7. Your authorization server authenticates the user and issues an access token to the client application.
8. The client application accesses a Web API of your service with the access token.
9. The Web API of your service checks whether the presented access token is valid or not.
10. If the access token is valid, the Web API returns a successful response to the client application.

RFC 6749 (The OAuth 2.0 Authorization Framework) defines 4 flows to issue an access token. Check the specification.