Security (oAuth 2.0)

Our implementation efforts based on the following documentation raise questions (below) and are incomplete (TODOs below).

#Documentation

We have relied on the following documentation:

• Google: https://developers.google.com/accounts/docs/OAuth2WebServer
• Facebook: https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow/
• Twitter: https://dev.twitter.com/docs/auth/application-only-auth
• Windows Live: http://msdn.microsoft.com/en-us/library/dn631818.aspx

#Identity provider configuration

The configuration of oAuth 2.0 identity providers starts at:

• Google: https://console.developers.google.com/project
• Facebook: https://developers.facebook.com/apps/
• Twitter: https://apps.twitter.com/app/
• Windows Live: https://account.live.com/developers/applications

Note: Create a redirection in %systemroot%\system32\drivers\etc\hosts (windows) in order to mock a public domain especially for Windows Live

#Questions

1. Are there reasons to maintain a username + password in addition to oAuth 2.0 authentication like most sites (except identity providers' sites) do? At this stage, we have assumed that we could rely entirely on external identity providers.
2. The code at https://github.com/jlchereau/Phonegap.Express/blob/master/api/routes/authentication.js might reinvent the wheel considering passport-oauth2 and derived modules including passport-facebook, passport-google-oauth and passport-windowslive but we could not really figure out how to use them alongside passport-http-bearer.
3. Do we need refreshing tokens noting that Google and Windows Live tokens expire after 1 hour (3600 seconds) but can be refreshed and Facebook tokens have a much longer life span but cannot be refreshed?
4. How is logout/signout different from revoking tokens?

#TODOs

1. Implement the Twitter flow considering (1) there is no request of an authorization code prior to requesting an access token, (2) the clientSecret shall not be disclosed to the HTML5 application.
2. Implement signout and token revocation properly (is this the same thing?)
3. Implement offline access and refreshing tokens
4. Implement sharing on Facebook, Google+ and Twitter
5. Link accounts
6. After agreeing a proper logging/error handling architecture, integrate
7. After agreeing a proper CI + QA/Tests platform, develop tests
8. Consider Yahoo and LinkedIn

• Missing: offline access + refresh tokens + revoke token + link accounts
• Questions: refresh tokens and impact on signout; see: https://developers.facebook.com/blog/post/2011/05/13/how-to--handle-expired-access-tokens/