node.js API authentication

Question

I am working on an iOS application which communicates with a nodejs backend server REST API and I am thinking about API authentication.

I want that only the iOS application can communicate with the API.

On iOS application side, users are authenticated through Facebook login. They thus get a fb access_token and a fbid after authentication on the iOS app.

For the API authentication, I plan to make it this way:

When the user logs in into the iOS app, a call to /api/auth with his fb access_token and fbid is done;
If the user is new, I create a random api_token for this user, store it into Users DB, and send it back to the iOS app;
If the user is already in the DB, I refresh the fb access_token in my DB and the api_token and send it back to the iOS app;
For each API call, I give the api_token as a POST parameter and on server side I check if it is valid by fetching in the DB before executing the API call.

Am I missing something to be enough secured?

Any feedback or improvement will be very welcome.

Regards,

EDIT:

Another way would be the following:

On /api/auth I checked on FacebookB API (/me) if the fb access_token is still valid;
If not I refuse the authentication;
If yes I create and manage my api_token with JSON Web Tokens.

Thomi Thomi · Accepted Answer · 2016-04-03T14:59:26

If anyone is interested, I finally implemented the second solution. Very simple and do the job!

config.js

module.exports = {
    'secret': 'apisupersecrethere',
};

route.js

var config = require('./config');
app.set('api_secret', config.secret);
api = express.Router();

// function that checks the api_token
api.use(function(req, res, next) {
    var token = req.headers['x-access-token'];
    if (token) {
        jwt.verify(token,app.get('api_secret'),function(err, decoded) {
            if (err) {
                return res.json({
                    success: false,
                    message: 'Failed to authenticate token.'
                });
            } else {
                req.decoded = decoded;
                next();
            }
        });
    } else {
        return res.status(403).send({ 
            success: false, 
            message: 'No token provided.'
        });
    }
});

// route protected by the authentication
router.use('/users', api);

// authentication route
router.post('/auth', function(req, res) {
    verifyFacebookUserAccessToken(req.body.access_token).
        then(function(user) {
            var token = jwt.sign(user, app.get('api_secret'), {
                expiresIn: 1440*60 // expires in 24 hours
            });
            res.status(200).json({
                success: true,
                message: "Authentication success!",
                token: token
            });
        }, function(error) {
            res.status(401).json({
                success: false,
                message: error.message
            });
        }).
        catch(function(error){
            res.status(500).json({
                success: false,
                message: error.message
            });
        });
    });

// Call facebook API to verify the token is valid
function verifyFacebookUserAccessToken(token) {
    var deferred = Q.defer();
    var path = 'https://graph.facebook.com/me?access_token=' + token;
    request(path, function (error, response, body) {
        var data = JSON.parse(body);
        if (!error && response && response.statusCode && response.statusCode == 200) {
            var user = {
                facebookUserId: data.id,
                username: data.username,
                firstName: data.first_name,
                lastName: data.last_name,
                email: data.email
        };
            deferred.resolve(user);
        }
        else {
            deferred.reject({
                code: response.statusCode,
                message: data.error.message
            });
        }
    });
    return deferred.promise;
}

Any feedback welcomed.

Regards

node.js API authentication

EDIT:

1 Answers