I'm implementing social login with Facebook, Twitter and Google+ on our OAuth2-secured REST API (secured using
spring-security-oauth). I'd like to make sure that the following flow is secure and that I'm not introducing any security holes.
There's a REST API and three types of client applications: web, iOS and Android. Communication between the API and client applications is made through HTTPS.
- Client applications initiate the social login flow either via the browser or native apps, and make the whole "OAuth dance". They obtain a user ID and an access token corresponding to this user ID.
- Client applications send user ID and access token to the REST API as
POSTparameters to our OAuth2 token endpoint specifing a custom
- The REST API contacts the corresponding social network and validate that
- The access token is active.
- The access token was generated for the specified user and for our application.
- If the above conditions are met, we grab from our DB the user with the specified external ID and generate our own access token which can be used in further requests. The access token is never saved to our database, only the user ID.
I'd like to know whether this is the correct way of implementing social login in this scenario and if there are any pitfalls to this whole flow.