CODEWITHSUNDEEP
ruby-on-railsfacebookrestoauthomniauth
Fakada
Fakada

Reputation: 563

Is it possible to use facebook oauth to secure my json API?

I'm developing a mobile app that will interact with a rails app that's essentialy a json api. Is it possible to use an external identity provider such as facebook or googleplus to secure the access to my API?

Users will upload a photo to a json rest service but the rails app would only allow the upload if the uses is authenticated with one of those providers.

I've checked omniauth gem but I don't know if that's the path to do it. I don't understand very well how oauth works so I'm trying to know if this would be possible to do.

Regards Fak

Upvotes: 0

Views: 208

Answers (1)

Chris
Chris

Reputation: 131

The answer, in part depends on how you're going to provide Identity via the mobile app. The user's authentication, and their identity are de-coupled.

My guess is you're wanting the user to authenticate to the mobile app using the Google/Facebook sdk app side. To do so, you'll need to use that sdk to generate a token, which can then be saved to Rails. The token can then be required as part of each API request - which rails will validate.

The topic is a bit complex to fully describe the flow....but in essence: 1) Create the token on the mobile app using the mobile sdk, 2) save the user and token to Rails/database, 3) as part of every request check the access_token provided.

Since the topic of Oauth and request/identity providers takes some time to understand, I would first watch he following railscasts on securing an API. Once you're done with that one (and understand the concept), you can also watch this railscast.

Hope this helps.

Upvotes: 2

Related Questions