Working with Node, Express, and Passport.
Okay, so my team and I are building a REST API for a dual-sided marketplace type application. We have already set up a basic LocalStrategy for email and password login.
We want to make the API user-agent agnostic, so we can use the API via web, Android, or iOS.
But where we are getting confused is with the FB login flow. The question is, what exactly goes on behind the scenes in Passportjs. We have looked into the 'passport-facebook' and 'passport-facebook-token' strategies, and can't really decide which one to go with.
This is my current understanding of the flow:
If this is correct, am I better off having the client get the access_token from FB then sending it to me, or just letting FB handle it via redirects and the callback URL?
Passport-token:
passport.use('facebook-token', new FacebookTokenStrategy( {
clientID: 'xxx',
clientSecret: 'xxx'
}, function(accessToken, refreshToken, profile, done) {
// asynchronous
//console.log("into passport auth");
process.nextTick(function() {
User.findOne({'facebook.id': profile.id}, function(error, user) {
console.log("user is " + JSON.stringify(user));
console.log("profile is " + JSON.stringify(profile));
//do user creation stuff etc.
return done(error, user);
});
});
}));
authRouter.post('/facebook', passport.authenticate('facebook-token'), function (req, res) {
console.log("into controller");
if (req.user){
//log the user in since they successfully authenticated with facebook.
req.login(user);
res.status(200).end();
} else {
res.status(401).end();
}
});
Passport-facebook:
passport.use('facebook', new FacebookStrategy( {
callbackURL: "http://75.128.65.176:8080/auth/facebook/callback",
clientID: 'xxx',
clientSecret: 'xxx'
}, function(accessToken, refreshToken, profile, done) {
// asynchronous
//console.log("into passport auth");
process.nextTick(function() {
User.findOne({'facebook.id': profile.id}, function(error, user) {
console.log("user is " + JSON.stringify(user));
console.log("profile is " + JSON.stringify(profile));
//do user creation stuff etc.
return done(error, user);
});
});
}));
// Redirect the user to Facebook for authentication. When complete,
// Facebook will redirect the user back to the application at
// /auth/facebook/callback
authRouter.get('/facebook', passport.authenticate('facebook'));
// Facebook will redirect the user to this URL after approval. Finish the
// authentication process by attempting to obtain an access token. If
// access was granted, the user will be logged in. Otherwise,
// authentication has failed.
authRouter.get('/facebook/callback',
passport.authenticate('facebook', { successRedirect: '/',
failureRedirect: '/login' }));
Any details/elaboration on how this flow actually works would be GREATLY appreciated!
