android - Need clarification on the proper way to Authenticate (Android app)

Question

We have implemented a Backend Server and a DataBase, with RESTFUL API. We have an Android App that can ask the server to send certain data back.

We want to implement an authentication system on the Android App.

The team suggests that I use Spring and OAuth, but I personally have no experience with those, and am not exactly convinced about the necessity of this approach.

Other friends suggest using FireBase to authenticate the users.

Could I avoid using OAuth/FireBase and simply store in the Server's Database the user's account name and its corresponding hash-salted password, along with the salt? Every request sent from the client would contain the account's name (which could probably be a unique ID generated by the server on the very first request, and saved as a SharedPreference in the phone) and the password in clear. The transmission of the request being done via HTTPS protocol (thus using TLS/SSL), the password in clear would not be revealed.

What are the possible flaws to the suggested approach in the last paragraph? And if it is a flawed approach, considering we already are using Spring for the Server (Backend), should I go for FireBase or OAuth ?

Additional context:

Bare in mind that this is the very first largish-scale project that I have been working on (it counts as a 3-credits University course). We are 3 on the project. I'm studying Computer Science but I do not necessarily have a great grasp on all the systems we are using or plan on using.

We are creating an app which allows users to view on a map alerts published by certain databases (we are currently focusing on meteorological alerts) in real-time. We want to be able to implement a login system so that people can receive notifications despite the application being closed (we are allowing users to "subscribe" to areas on the map, to specify the regions they want to receive notifications for).

标签： androidspringfirebaseauthentication

Answer 1

OAuth 或更好的 OpenId Connect 是一种协议，而 FireBase 只是其商业实现之一。在可能的情况下遵循标准总是比实施自己的标准更好。要查看经过认证的 OIdcC 实现的完整列表，请查看OIdC 站点，我至少看到了与 Spring 相关的MITREid Connect项目。我认为您的自定义解决方案将适用于您的自定义案例，但前提是您考虑任何可扩展性，例如 Google auth 或访问某些 3-rd 方 API。