12

I've implemented the oAuth in php (currently for twitter) and as I've read in several tutorials you should store the access token in db for future use. However I don't see how you know if you have the access token stored for a particular user to decide if you should pull it out of the db or regenerate it. Here's a flow describing my question:

First time user signs in:

  • get request token
  • send user to provider's authentication page
  • user returns to callback url with oauth token and oauth verifier
  • get access token
  • save access token/user_id/screen_name on db for future use

User returns 10 minutes later:

  • access token is still in server session vars if user didn't log out. else, repeat process.

User returns 1 month later:

  • get request token
  • send user to provider's authentication page
  • user returns to callback url with oauth token and oauth verifier
  • ( at this point I only have oauth tokens, how can I know if the user has previously logged in with twitter and pull their access token from db? )
  • if it is the user's first loggin, generate access token.

The main workflow for oAuth is clear, however it is not clear how to handle returning users and which data should be stored or not.

A million thanks!

Juank
  • 6,096
  • 1
  • 28
  • 28

2 Answers2

22

You should not regenerate token for each access. Generate it only when it's expired. I've build twitter application using OAuth. Here my flow:

  1. when user login, I will check if they have token in DB

    1.1. If it's not exists, authenticate them and then store and use the resulting token

    1.2. If it's exists, use it.

    1.2.1. If twitter doesn't complain, then the token still valid, use it.

    1.2.2. If twitter complained, then the token is expired. Return to 1.1.

    1.2.3. If after x retry twitter still complained. Something wrong, notify admin!

Here's the graphical explanation:

enter image description here

ariefbayu
  • 21,849
  • 12
  • 71
  • 92
  • 1
    Thanks @silent,great diagram and explanation.But the problem I have still exists.In your flow this would happen on points 1.1 and 1.2. How do you know if the user has a token in DB? Lets say I access your site and click login with twitter.Your app gets a request token (not useful to recognize user), and then sends me to twitter where I will login with my user/pass.This sends me back to your app's callback with a token and a verifier (is this the token I should store?is it unique for every user?) then with this your app requests the access token and receives a token,secret and user_id. Thanks! – Juank Oct 07 '11 at 18:37
  • ah, yes, the token is what your app callback received. you check if it's exist in db (means your user already authenticated), if not (your user never authenticated) authenticate them and store the callback result. – ariefbayu Oct 07 '11 at 23:13
  • 2
    I'm having the same problem and I don't quite get the flow. How can we check if we have a token for the user if we don't know who the user is? If someone clicks the login with Twitter button, I get a request token. As Juank commented above, I can't see how this can be used to identify the user? If at this stage, we don't know who the user is how can we test if we have a saved token without having them go through Twitter authentication again? – baseten Dec 01 '12 at 13:54
  • Did you guys get any clarity about all this? Still trying to figure out how this flow is supposed to work. – INT Jul 09 '14 at 15:00
0

The only thing I believe is missing here, is generate a random (long and unguessable) user id first time the user joins the system, and store it forever. this way you can tell who's taking the actions

YaNuSH
  • 927
  • 9
  • 10