Pros and cons of using OAuth to authorize your own mobile application

In general, OAuth is used when a web service needs to allow third-party access to a protected resource.

However, if I have my own mobile application and my own web service, and I will not expose my API to third-party applications in the foreseeable future, is there any reason to use OAuth to authenticate the user? What are the advantages and disadvantages of using OAuth in this case?

+4
source share
1 answer

One of the biggest advantages to using your own APIs like a third party is that you are dogfooding your own systems. This leads to a significant improvement in the product as a whole, because you, as a rule, first smooth out the flaws and hiccups, since they directly affect you, and not only third-party consumers notify you of problems.

Another advantage of using OAuth is that you do not need to reinvent the wheel, and this is already a very well supported mechanism. Users are also very familiar with this, so you keep the barrier to entry (and to maintain) lower than if you went the other way.

Since you do not expect to expose the API for anyone else right away, the advantages, as you suspected, are less, but if you jump to expose it on the road, you will be far ahead of the game, forcing yourself to use it directly from the gate.

One drawback is that OAuth is a bit more complicated than other possible authentication mechanisms, but I still think that the net profit from not reinventing the wheel outweighs the little extra complexity.

+3
source

Source: https://habr.com/ru/post/1441592/


All Articles