Question

I have an iOS which uses OAuth and OAuth2 providers (Facebook, google, twitter, etc) to validate a user and provide access tokens. Apart from minimal data such as name and email address, the app doesn’t uses these services for anything except authentication.

The app then sends the access token to a server to indicate that the user is authenticated.

The server is written in Node.js and before doing anything it needs to validate the supplied access token against the correct OAuth* service.

I’ve been looking around, but so far all the node.js authentication modules I’ve found appear to be for logging in and authenticating through web pages supplied by the server.

Does anyone know any node.js modules that can do simple validation of a supplied access token?

Answer 1

To the best of my knowledge (and as far as I can tell from reading the specifications) the OAuth and OAuth 2 specs do not specify a single endpoint for access token validation. That means you will need custom code for each of the providers to validate an access token only.

I looked up what to do for the endpoints you specified:

Facebook

It seems others have used the graph API’s ‘me’ endpoint for Facebook to check if the token is valid. Basically, request:

https://graph.facebook.com/me?access_token={accessToken}

Google

Google have a dedicated debugging endpoint for getting access token information, with nice documentation, too. Basically, request:

https://www.googleapis.com/oauth2/v1/tokeninfo?access_token={accessToken}

However, they recommend that you don’t do this for production:

The tokeninfo endpoint is useful for debugging but for production
purposes, retrieve Google’s public keys from the keys endpoint and
perform the validation locally. You should retrieve the keys URI from
the Discovery document using the jwks_uri metadata value. Requests to
the debugging endpoint may be throttled or otherwise subject to
intermittent errors.

Since Google changes its public keys only infrequently, you can cache
them using the cache directives of the HTTP response and, in the vast
majority of cases, perform local validation much more efficiently than
by using the tokeninfo endpoint. This validation requires retrieving
and parsing certificates, and making the appropriate cryptographic
calls to check the signature. Fortunately, there are well-debugged
libraries available in a wide variety of languages to accomplish this
(see jwt.io).

Twitter

Twitter doesn’t seem to have a really obvious way to do this. I would suspect that because the account settings data is pretty static, that might be the best way of verifying (fetching tweets would presumably have a higher latency?), so you can request (with the appropriate OAuth signature etc.):

https://api.twitter.com/1.1/account/settings.json

Note that this API is rate-limited to 15 times per window.

All in all this seems trickier than it would first appear. It might be a better idea to implement some kind of session/auth support on the server. Basically, you could verify the external OAuth token you get once, and then assign the user some session token of your own with which you authenticate with the user ID (email, FB id, whatever) on your own server, rather than continuing to make requests to the OAuth providers for every request you get yourself.