jeudi 22 août 2019

Laravel Passport : Setup for multiple clients - React & Mobile app

I'm creating an application where Laravel will be used to serve as the API server. My APIs will be accessible with endpoints such as

company.com/api/v1/..

I will have two first party clients which will be consuming the apis

  1. A react web application
  2. iOS mobile application

For authentication, I'm using passport and I generated two password grant clients (for react and iOS) using the command

php artisan passport:client --password

I have the following questions:

  1. Should each client store the client_id and client_secret and make a post request to company.com/oauth/token endpoint to obtain tokens?
  2. Or Should all clients use company.com/api/v1/auth/register and the controller stores the client credentials which then calls the company.com/oauth/token to obtain tokens.
  3. If 2. should I create a separate route to identify each client? Like company.com/api/v1/auth/login/react and company.com/api/v1/auth/login/ios? Since I need to use the appropriate client credentials to make the request to Oauth API.
  4. If a user logs out on the React App, this should not affect his login on iOS App. How can one achieve this and how can one ensure user has one valid token per client_id?
  5. Lastly, when a user logs out. Should you revoke or delete the token? If revoke, if the user logs in again should we refresh the revoked token?

Thanks in advance!



via Chebli Mohamed

Aucun commentaire:

Enregistrer un commentaire