I'm creating an application where Laravel will be used to serve as the API server. My APIs will be accessible with endpoints such as
company.com/api/v1/..
I will have two first party clients which will be consuming the apis
- A react web application
- iOS mobile application
For authentication, I'm using passport and I generated two password grant clients (for react and iOS) using the command
php artisan passport:client --password
I have the following questions:
- Should each client store the
client_id
andclient_secret
and make a post request tocompany.com/oauth/token
endpoint to obtain tokens? - Or Should all clients use
company.com/api/v1/auth/register
and the controller stores the client credentials which then calls thecompany.com/oauth/token
to obtain tokens. - If 2. should I create a separate route to identify each client? Like
company.com/api/v1/auth/login/react
andcompany.com/api/v1/auth/login/ios
? Since I need to use the appropriate client credentials to make the request to Oauth API. - If a user logs out on the React App, this should not affect his login on iOS App. How can one achieve this and how can one ensure user has one valid token per
client_id
? - Lastly, when a user logs out. Should you revoke or delete the token? If revoke, if the user logs in again should we refresh the revoked token?
Thanks in advance!
via Chebli Mohamed
Aucun commentaire:
Enregistrer un commentaire