3

I have built a website with vuejs front-end and laravel back-end.

Only way to login is via Facebook Login using Socialite

All that works fine.

Now I am building some React Native apps (Ios/Android) that also use Facebook login but need to interact with the same web api.

I want to use JWT to secure the API for React Native -> Laravel API

I set up JWT w/ Dingo on Laravel side and I am able to generate a token using the JWTAuth::fromUser(). And I have established some API endpoints that use the token to authenticate.. so far so good.

Now here's the part that becomes sticky. I understand that on the Laravel side of things you can create JWT token with any user.. right now the JWT "identifier" is simply "id".. and it's my understanding that the token I generate from JWTAuth::fromUser() simply has no idea or care that this user doesn't have conventional credentials and instead used a Facebook Login.

On the React Native side however.. when a new user first authenticates via the Facebook Login.. it has no idea what the "matching user" is on the Laravel app, all I have to go on is basically the unique Facebook Provider Id.

So the question is as follows:

How can I generate a JWT token on the React Native side using only the Facebook Provider Id and the JWT Secret, and more importantly, how do I modify my JWT code on the Laravel side so that it can understand tokens that were generated with the Facebook Provider Id and JWT Token

In other words, I think my Laravel JWT implementation needs to be modified so that tokens are created/parsed purely on the basis of the Facebook Provider Id because otherwise it won't match up with tokens generated on the React Native side.

Many thanks!!

vesperknight
  • 720
  • 9
  • 17
  • 1
    When I've implemented Facebook logins before, I request the user's name, email, etc from Facebook, and then create a user account in the database, with their unique Facebook App ID associated with the account. Then when re-authenticating in the future, you get their ID again, and find the corresponding account in your database and load that user. – fubar May 29 '17 at 05:27

1 Answers1

13

Ok after doing some reading I think this flow might work. Your thoughts please?

1 User authenticates via Facebook on in on Android/Ios app

2 Retrieve facebook access token

3 Do api call to public endpoint on web server and pass FB Access Token and FB ID

4a Web server makes Facebook Graph Api call w/ Access Token and verifies token is valid, is authenticated with Facebook App, and matches Facebook ID

4b If user doesn't exist on web first.. create user

5 If above matches, then web servers generates JWT token from user model and returns JWT token to app

6 App now uses JWT token for future API calls

vesperknight
  • 720
  • 9
  • 17