Android native app with Firebase Auth and MySQL backend

Question

I am creating a native Android app which currently uses Firebase Auth to handle user authentication. I have a MySQL database behind a PHP site and I'm building a RESTful API to access those services. I would like users who are authorized to be able to access limited features and data.

In this scenario, what would be the approach to handling the permissions on the backend server? I'm new to Auth techniques such as OAuth etc, but I get the feeling that might be part of this solution, so feel free to talk to me like I'm an idiot. :)

[edit] My backend has similar permissions to Facebook; such as content is visible as either private, friends or public.

Regards

Community · Accepted Answer · 2021-10-07 07:24:50Z

1

It depends on your security design.

The easiest way is to have a role-based security - use OAuth2/OpenID Connect just for authentication (ask for an ID token, not access token). Then you must get a list of roles for an authenticated user. The roles could be part of the ID token or the API server could get them from another source (e.g. its database). If the role retrieval is an expensive operation, you could consider issuing your own token (JWT) containing all the info you need.

If you wanted to delegate just some of user's permissions to the mobile app, you could register the API scopes (permissions) to the OAuth2 server and the app could ask the user for some of them. As an example, if your application wants to access Google services on behalf of its user, the application asks for an access token with specific scopes (e.g. reading GMail inbox). But this is probably not what you want.

Edit: If the objects you deal with have access rights defined on themselves (private, public, friends visible), then just get a user identity (ID token) from the OAuth2 server and check the permissions when someone requests such an object by your API. OAuth2 itself cannot help you with that.

And for your Android app, use the Authorization Code Grant Flow as described in the OAuth2 for native apps RFC.

edited Oct 7, 2021 at 7:24

CommunityBot

11 silver badge

answered Jul 24, 2017 at 15:05

Ján Halaša

8,4961 gold badge40 silver badges37 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Gary Paluk Over a year ago

My backend has similar permissions to Facebook; such as content is visible as either private, friends or public.

Collectives™ on Stack Overflow

Android native app with Firebase Auth and MySQL backend

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related