Security (oAuth 2.0)

Our implementation efforts based on the following documentation raise questions (below) and are incomplete (TODOs below).

#Documentation

We have relied on the following documentation:

• Google: https://developers.google.com/accounts/docs/OAuth2WebServer
• Facebook: https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow/
• Twitter: https://dev.twitter.com/docs/auth/application-only-auth
• Windows Live: http://msdn.microsoft.com/en-us/library/dn631818.aspx

#Identity provider configuration

The configuration of oAuth 2.0 identity providers starts at:

• Google: https://console.developers.google.com/project
• Facebook: https://developers.facebook.com/apps/
• Twitter: https://apps.twitter.com/app/
• Windows Live: https://account.live.com/developers/applications

Note: Create a redirection in %systemroot%\system32\drivers\etc\hosts (windows) in order to mock a public domain especially for Windows Live

#Questions

1. Are there reasons to maintain a username + password in addition to oAuth 2.0 authentication like most sites (except identity providers' sites) do? At this stage, we have assumed that we could rely entirely on external identity providers.
2. The code at https://github.com/jlchereau/Phonegap.Express/blob/master/api/routes/authentication.js might reinvent the wheel considering passport-oauth2 and derived modules including passport-facebook, passport-google-oauth and passport-windowslive but we could not really figure out how to use them alongside passport-http-bearer.
3. Do we need refreshing tokens noting that Google and Windows Live tokens expire after 1 hour (3600 seconds) but can be refreshed and Facebook tokens have a much longer life span but cannot be refreshed?
4. How is logout/signout different from revoking tokens?

#TODOs

The TODO list is maintained as a list of issues.

#Features (Use Cases)

??????