I've developed my own custom authorization grant.

The steps I am undertaking are the following:

  1. I get the facebook authorization code from the mobile device (this is an an API for mobile devices)
  2. I exchange the auth code for a Facebook access token using curl. I save access token in the database and associate it with a user that I created using the facebook data (api('/me'))
  3. I return the access token to the mobile device
  4. Mobile device makes a POST request to my oauth endpoint providing the access token. At this stage, I take the access token from the form, validate it as a string, inspect it using the Facebook Graph API (with curl) to make sure the app id and user id match and then look it up on my database. If a row exists, I check whether the associated user's email matches the email provided in the POST data along with the token. If it matches, I return the user_id and generate my app-specific token using oauth.

All of this is done in an HTTPS environnment.

Is this considered to be secure?

EDIT: I ended up using this package for Laravel. I still need to create a user with the facebook data on my database, but the authentication part is now handled by the package.

  • Doesn't oauth have a model for you to use? – schroeder Jul 1 '14 at 19:52
  • What do you mean? – Onion Jul 1 '14 at 19:55
  • If you're referring to the authorization grant, then no, it doesn't apply here. I had to implement my own one. Is it secure though? – Onion Jul 1 '14 at 19:56
  • OAuth is used by many services. They all have authorization grants. Have you investigated their models? – schroeder Jul 1 '14 at 20:01
  • No, I haven't. The method I came up with is specific to the implementation of the API I'm developing, but in general, it should be common. – Onion Jul 1 '14 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.