joehua87 / easy-auth-api Goto Github PK

• Facebook
• Google
• Verify that user on social network (server check) #2

Use token sent from browser to verify that account is really exists on social network

• Migrate the get user profile to server side?

Problem:

1. User A has the token XXX (which is valid) for application App-01
2. For some reason, App-01 want to immediately revoke the token from user A

We can utilize expire time on JWT itself (example use case: monthly subscription)

Solution 1:

• Update User A status for App-01 on Auth-Server
• Auth-Server will send a request to App-01 to let App-01 know that User A token is revoke
• App-01 will check if User A token is valid (on App-01 database instead of Auth-Server's database)

Solution 2:

• Update User A status for App-01 on Auth-Server
• App-01 must connect to Auth-Server to check if the token is still valid?

References

• https://auth0.com/docs/api-auth/tutorials/verify-access-token