I'm creating an application where Laravel will be used to serve as the API server. My APIs will be accessible with endpoints such as
company.com/api/v1/..
I will have two first party clients which will be consuming the apis
- A react web application
- iOS mobile application
For authentication, I'm using passport and I generated two password grant clients (for react and iOS) using the command
php artisan passport:client --password
I have the following questions:
- Should each client store the
client_idandclient_secretand make a post request tocompany.com/oauth/tokenendpoint to obtain tokens? - Or Should all clients use
company.com/api/v1/auth/registerand the controller stores the client credentials which then calls thecompany.com/oauth/tokento obtain tokens. - If 2. should I create a separate route to identify each client? Like
company.com/api/v1/auth/login/reactandcompany.com/api/v1/auth/login/ios? Since I need to use the appropriate client credentials to make the request to Oauth API. - If a user logs out on the React App, this should not affect his login on iOS App. How can one achieve this and how can one ensure user has one valid token per
client_id? - Lastly, when a user logs out. Should you revoke or delete the token? If revoke, if the user logs in again should we refresh the revoked token?
Thanks in advance!
via Chebli Mohamed
Aucun commentaire:
Enregistrer un commentaire