CODEWITHSUNDEEP
databaseauthenticationoauthgithub-oauth
Ayyli
Ayyli

Reputation: 125

How should I store OAuth with my own authentication system?

I have an existing signup/login system: a user enters an email and password. The password is hashed. I store it in a database.

When a user logs in, they entire their email and password. The password is hashed, and I look up the email in the database and check that the email matches. If it does, they are logged in.

I want to add a system to let users login with a 3rd party OAuth, such as GitHub. I have that setup, but I am unsure what data to store in my database.

I was thinking I take their GitHub email as the email and then use the access token for their GitHub as the password (so I would hash it and store it.)

I think this would work, but I am worried that the access tokens could change meaning they would be locked out of their account.

If I shouldn't be using the access token as a password, what should I be using? I need to store the user's email on my database but that requires a password currently, which I can't get if they use GitHub login.

(Note that when the user logs in, I call my backend to generate an access token (JWT) which I can use to require their user details and then store it in local storage. I'd like to then be able to do the same thing with with GitHub or whatever.)

Upvotes: 8

Views: 6530

Answers (2)

OhadR
OhadR

Reputation: 8859

oAuth is usually for authorization. Meaning, you get an access token from the authorization server, the resource server validates it and let the user access to the data.

In your case, you "do not really need" the access token - you want to use oAuth just for the authentication. Web-applications (like StackOverflow) do this to "save the trouble" of handling the authentication flows. Meaning, if I write a secured application, I need to implement somehow the create account flow, login flow, forgot password, etc. When you use a 3rd-party authentication, you save this trouble.

However, your application does need some user-id to perform actions; so you must create a user-id in you app when a user appears for the first time. Since then, you do not need to worry about password-expiry, forgotten-password and even not for the login. When the user logs-in, you get the access token and all you need to do is to get yours app' user-id from it.

Thus, I do not see a reason why you need to store a 'password', or the access token.

Hope that makes sense.

Upvotes: 5

Michal Trojanowski
Michal Trojanowski

Reputation: 12352

What you are looking for is actually OpenID Connect - it's an authentication framework built on top of OAuth, which lets you log in users using external Identity Providers, like Github.

When a user logs in using GitHub then you will receive an id_token in a form of a signed JWT. You can easily verify the authenticity of the JWT - so you can easily make sure that the id token really comes from Github and presents real data. Usually one of the information in the id token will be the user's email. You can use that to look up the user in your database. You don't need any password in this case.

So, you will have two ways of finding a user in your DB - either through comparing the email and password, or by looking up the user's email from a validated id token from Github.

Upvotes: 0

Related Questions