I've developed my own custom authorization grant.
The steps I am undertaking are the following:
- I get the facebook authorization code from the mobile device (this is an an API for mobile devices)
- I exchange the auth code for a Facebook access token using curl. I save access token in the database and associate it with a user that I created using the facebook data (api('/me'))
- I return the access token to the mobile device
- Mobile device makes a POST request to my oauth endpoint providing the access token. At this stage, I take the access token from the form, validate it as a string, inspect it using the Facebook Graph API (with curl) to make sure the app id and user id match and then look it up on my database. If a row exists, I check whether the associated user's email matches the email provided in the POST data along with the token. If it matches, I return the user_id and generate my app-specific token using oauth.
All of this is done in an HTTPS environnment.
Is this considered to be secure?
EDIT: I ended up using this package for Laravel. I still need to create a user with the facebook data on my database, but the authentication part is now handled by the package.