Leverage MCA server SDK to secure backend endpoints.

[rolivieri]

Secure only the following endpoints using the new MCA SDK for the server:

• get("/users/:userId")
• get("/users")
• post("/users/:userId/images/:fileName/:caption/:width/:height/:latitude/:longitude/:location")
• post("/users")

Please note that securing the /users/:userId/images/:fileName/:caption/:width/:height/:latitude/:longitude/:location POST endpoint implies that:

• The userId (Facebook ID) is retrieved from the MCA server SDK.
• Simple logic should then be implemented to validate that the userId request parameter in the URL matches the Facebook ID retrieved through the MCA SDK on the server. If they don't match, then we throw an error (user is not authorized). For the other endpoints listed above, we don't need to perform this validation.

[rolivieri]

Here's an update from Anton: "I’ve also confirmed that MCA will give you facebook userId at the server side. No need to do anything. see the sample code here - https://github.com/ibm-bluemix-mobile-services/bms-mca-kitura-credentials-plugin. You can do authContext.userIdentity.id, it will hold fb user id."

[tfrank64]

Currently blocked by this error, communicating with @AntonAleksandrov on a soultion

[aal80]

@tfrank64 I've updated the package. Please try with v0.1.1

[tfrank64]

@AntonAleksandrov seems to have fixed the issue. thanks!

[tfrank64]

Last test to confirm is post("/users/:userId/images/:fileName/:caption/:width/:height/:latitude/:longitude/:location")

Denies request as expected when passing no auth token. Still need to test in iOS app.

[rolivieri]

Unfortunately, this issue has to be moved to the next milestone. We are currently blocked by this issue: Kitura/Kitura#487.