1

I am trying to build an aggregator of content from several social networking services like Facebook, Google+, Instagram etc. This is both for viewing as well as posting. My usecase is like

  1. User authorizes whatever sites they want to. System stores the tokens (offline tokens or long term tokens so that user does not have to re-authorize frequently)
  2. On a the content screen, the system pulls the list of content from the social networks and displays them.

Simple right? My problem is that I do not really need to pull content "offline" on the server side, rather on demand on the client side when the user is browsing. The standard way for doing this would be the client (browser) to call my servers, which in turn pulls the contents from using the apis and serve them back to the client. This way the oauth token and credentials are never sent to the client.

My preferred way would be to have the client directly call the apis (JSONP) and pull the content. However I have to pass the token and credentials back to the browser where they are exposed. They are not stored in any kind of client side storage (html, local storage, session etc.), however with this mechanism, the vulnerability is with shared computers and devices if an un-suspecting user does not log out after they are done, or a smart user reviews the browser history and finds the access-tokens that are still active (+ other ways).

An alternative can be to use client side SDKs but the problems are

  1. not all the services I want to integrate have javascript SDK

  2. UI/look and feel are inconsistent (can be managed)

  3. Will potentially increase the frequency of re-authorization (because of short term tokens)

I will be consuming selective content so the scopes will be limited, however my biggest concern is that I will be seeking permission to post, which can be utilized to post/delete unauthorized content if the credentials are stolen.

Are there any best practices, mechanisms to secure the (long term/offline) oauth credentials while still using them to make api calls from browser directly?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.