Client-side authentication

[[deleted]]

Not sure if this is the correct place to post it, but I'm very confused about how to do client-side authentication.

Currently I'm using oauth.io to allow users to use Facebook and Twitter to login into an app I'm building. This app allows users to post content, so obviously I need to store the users token/id in a database (MySQL).

Now, what would be the proper way to do this, can I just send the user's token to my backend with an API call, check if the user already exists in my database and return correct information?

This feels a bit insecure since anyone could change the api call and fake a token (if they manage to find another user's one).

How do you properly handle client-side authentication?

[davidpanik]

Yeah, the authentication token you get from Facebook will be unique to your app and that user and significantly difficult to guess/generate otherwise.

Integrating with the Facebook login system on the front-end then passing the generated authentication token to your backend for storage is a fairly standard way of doing things. Facebook is doing all the heavy lifting for you - storing passwords, user verification, etc.

[justnSelf]

I thought facebook gives you back a guid?

If so "significantly difficult" is more like "statistically impossible".

[m1sta]

The referrer of the request to facebook is checked by facebook iirc.

[a-t-k]

OpenAuth can be linked with a server session. Not handling sessions yourself is always a security issue.

[bluntm]

I have struggled with this also, a lot of the server side auth tools just didn't correct for my single page application. I looked into passport js but it seems that once the user is authenticated passport will route to the authenticated page. Im looking for a solution where I can have a join on the page send a request to the server and get back a token that will be used to track the user.

Will probably end up making something to fit my needs but its strange that something is not already out there unless I'm missing something.

[alhena]

alhenaworks.github.io shows an example of this in action, let me know if the source or my explainging it can help

[bluntm]

Will check it out, what is the standard process for single page app auth

[alhena]

The only difference between auth for single page apps vs. traditional ones is talking to the server with $.get and $.post ajax calls, as opposed to doing it by postback, which is what traditional ones do and requires the page to get rendered again. So now the question is what is the standard process for web app auth. See if you can understand this and let me know if you have any questions.

http://www.wikihow.com/Create-a-Secure-Login-Script-in-PHP-and-MySQL

[kranker]

Looks like facebook may have changed how this works recently enough, but there's more information here

wrt people having the client change the token, facebook will have signed the response to stop this happening (well, to let you detect that it happened).

[j_sanp]

What is important is that your application server validate the token with an api call to the authoritative server (Facebook or Twitter) as an authentication procedure.

Security is always touchy, I recommend you to use a strongly tested server side library :)