Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn.

When the book club becomes popular, we discover that 3rd party apps want to read data from our database. We store things like: the list of books each person has read, the queue, and what they thought of each book. The third parties (Amazon, Barnes and Noble, etc) want to read that data, under the context of the logged in user.

Question

  • How should I design the OAuth login scheme for my website?
  • Can I rely on 3rd parties? (Google, twitter, anyone else?)
  • Once logged in, how can I share a subset of my data with 3rd party apps

  • Is the only way I can achieve this is if the IDP (Google or Yahoo) adds support for this (say in OAuth 3)?

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.