8

I'm a bit confused about how to properly and securely authenticate users using my REST API and provide and option to authenticate using other OAuth 2.0 providers as well (e.g. Facebook, Google, etc.).

Scenario

Users interact with a web application which should consume my REST API. Users should be able to login and perform CRUD operations both using username/password and by using 3rd party services such as Facebook. I will be using SSL to encrypt the traffic to the website and the API.

Without taking the 3rd party login services in consideration and by studying the various questions already asked here on SO, I thought about handling user authentication as in the picture.

Authentication Sequence

Technologies and current idea

The REST API is written using JS using NodeJS and Express. The WebApp provided through another NodeJS instance is mostly AngularJS with templates which consumes the REST API.

My current idea is to let the WebApp handle the login sequence and let Facebook save their token in my DB using the callback. But this solution smells too much of workaround!

Questions

  1. Is the authentication sequence depicted in the image correct?
  2. How is the above authentication sequence compared to the Resource Owner Password Credential flow in OAuth2.0? Is it worth using OAuth2.0 instead of it?
  3. How can I integrate login through 3rd parties (i.e. Facebook)? Any suggestion or (better) example?

References

passport.js RESTful auth

Login with facebook and using oauth 2.0 for authentication of REST api calls

And many others here on SO :)

4

1 回答 1

0

我的2美分..

  1. 这个过程对我来说看起来不错。我会在每次登录时重新颁发令牌，并将其保存在数据库中，以便可以轻松地撤销令牌。

使用 PassportJS。它支持 OAuth 流并支持许多 3rd 方集成，如 FB、Twitter、Github 等。由于它是一个 nodejs 中间件。它在您的应用程序中的集成将非常紧密。

于 2014-01-23T17:49:06.070 回答