4

I'd like to a make a mobile app that makes requests on behalf of a user. I understand the following OAuth flow:

  1. Open user in web view to give my app access to make requests on their behalf
  2. When they hit grant access, my server side app will receive a call with an authorization code
  3. My server side app then needs to exchange the authorization code for an access token

My confusion starts in Step 2. Uber makes a request to my endpoint with the authorization code, but I have no way of knowing what user that authorization belongs to. I can exchange it for an access token and store it in a DB for 30 days, but I have no way of getting it back to the user to use to make requests.

One thought was I could have the user sign in to my app with an email address which I could then use as a key to get the appropriate access token from my server app, but I have no way of associating the access token with an email address in my DB table in the first place.

I'm wondering what the best practices are here. How is my mobile app supposed to know what access token to use for a given user?

(I reached out to Uber API support directly, but they asked me to open a StackOverflow question instead)

sethfri
  • 1,307
  • 1
  • 15
  • 31

1 Answers1

2

Obviously this is kind of a broad question and is highly dependent on what type of app you're building, what you want the user-flow to look like, etc etc but I'll do my best to point you in the right direction.

First, the Uber API has the /v1/me endpoint which will return the users first name, last name, and email address, among other things. So one possible flow is that a User opens your app, they then go through the whole OAuth flow, and once you exchange the authorization code for an access token you immediately use it (from the server) to make a call out to the /v1/me endpoint and then use either the users email address or UUID as a key in your database. If you used email address, you could just allow users to login to your app using this same email address and allow the account creation process to just be the OAuth flow.

I'm not a mobile developer, but my understanding of embedded web views is that they can use cookies just like any other browser. In that case, another thing you could use is sessions / cookies. Assuming you have some kind of identifier for your existing users, you could add that as a cookie for your web server and then when your user gets redirected to your web server with the authorization code, the attached cookie will tell you which user to associate the access token.

Finally, the Uber developer platform includes a state parameter in the authorization phase of the OAuth flow as seen here https://developer.uber.com/docs/authentication You could do something similar to what I describe in the previous paragraph, except instead of using cookies you could store the user identifier in the state parameter and it'll be sent back to you when the user re-directs. You can use that piece of information to tie the access token back to a specific user in your DB.

I hope that helps! Don't hesitate to reach out if you're still confused.

Cheers!

Richard Artoul
  • 346
  • 4
  • 9