I'm developing a OAUTH service (I'm thinking so. It might not be exactly the same.) to open one of our back end API to a Merchants.

basically users can purchase goods from Merchant's E-Commerce website and can use our payment gateway to do the payment.

we have registration system for merchants and users and we are issuing a ID (publicly available alpha numeric ) to them.

My plan is for OAUTH service.

  1. First merchant sends above mentioned id to our OAUTH server.
  2. Then OAUTH server sending token, refresh token and expiry time as response.
  3. Then merchant sends that token with other required information such as amount again to OAUTH server to open our payment gateway web interface.
  4. user use that interface to provide his ID and pin to confirm the transactions.
  5. Then from over OAUTH server we call our back end RESTful service to do the actual transaction (Merchant account receive money and customer account will debited)
  6. After completion of transaction we redirect user again to merchant's website.

*All the communications are done via HTTPS channel.

I'm in doubt for

  1. Whether my approach is correct to secure the above given flow.
  2. Do I really need a tokens here or only ID is enough? If I only used ID what I'm going to missing here.
  3. If so only ID is enough to obtain a token?
  4. Is there any possibility that some one can cheat the process.

Expecting you advices on this.

  • This is not an oAuth procedure. oAuth is about an oAuth server "S" authorizing a system "A" to do certain actions on a system "B" on behalf of a user "U". that means A asks for authorization from S, S validates that U grants the authorization and then provides A with a token. A can then use the token to ask B to perform the action. B validates the token with S and if valid, performs the action. in your case B is also S (and that is possible, but usually not the case as most prefer to use a third party oAuth provider) and S grants the token before it validated U. – aviv Jan 30 '15 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.