My application is divised into two parts:

  • Javascript application as client
  • Server side API's (RESTFUL through Play!2.2 framework)

I expect users to be authenticated through Facebook's Oauth 2.0 client, especially with the Facebook Javascript SDK.

Once authenticated, users could call my various own apis, like POST /product etc...

Currently, I make use of a cookie-based token mechanism, implementing by this great plugin: SecureSocial.
Isn't a cookie anti RESTFULness? Perhaps not in this case, since I just store the access token... to be sent at each API call, like any other API KEY system would do, wouldn't it?

However, it forces me to use a persistence store (like memcached) to store the current cookie values corresponding to current connected users.
On the client side, each user store this cookie: "id: 12989348797024974..." (being a token sample based on many bits)

So, to sum up: I own a Javascript application (another project distinct from the server side) acting as the unique client of my Api's Server. I would not have currently other clients.

Should I stay with this cookie-based token that works great although the use of memcache (or other cache) or should I alter this strategy or even focused to another?


  • appart from you're problem, if you care about security do not use facebook api to authenticate but something more respectful for private life. The exploitation of personal data is a kind of security leak in my opinion – Kiwy Apr 2 '14 at 8:33
  • When the application makes no sense without facebook, it's different :) – Mik378 Apr 2 '14 at 8:35
  • Well it really depends what is your application, it's easier to rely on FB but not necessarily the good option in my opinion. I personnaly would never use my facebook account to login to anything except facebook, but I'm probably a bit paranoid :-) – Kiwy Apr 2 '14 at 8:37
  • @Kiwy Yes I would be paranoid too :) But the application is focused on Facebook like 10000 applications focusing on Facebook exist :) => Tinder for instance. I even would say: my question would stay similar if the client authentication was a traditional login/password strategy, and of course not focusing on 3rd party. – Mik378 Apr 2 '14 at 8:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.