Digits Authentication with Parse Server

Question

In building an a small Android app, I decided to try out Digits to login with a phone number and Parse for the back end.

How might I validate a Digits session with the Parse server?

I've started with the below example, though I'm not sure if this is 'correct' (adapted from this post).

Android Client:

Request auth (oauth?) token and user id from digits

a. Send in a digits key and secret, retrieve an object
Validate this session with Parse

a. Send in phone number, auth token, and user id

b. Receive acknowledge with user info if authorization is valid

Parse:

Auth endpoint takes phone number, auth token, and user id

a. Validate with twitter endpoint

b. Insert auth token hash and user id into a Sessions table (future requests will ping this table, not twitter)

c. Return acknowledge to client

The above makes sense, but a Parse Example with Github login seems to do something slightly different. With Parse, the initial request to the third-party is made from the Parse server, not the client.

Github requires a 'state' parameter to be sent in, which seems to be why the Parse example has its initial request sent from the server, whereas Digits does not require such parameter. Does this make the Digits authentication any less secure? Is there a way to make this process more secure/correct?

did you manage to integrate 2 together?

bartosz.lipinski
– bartosz.lipinski

2015-03-02 01:46:01 +00:00
Commented Mar 2, 2015 at 1:46 — bartosz.lipinski
– bartosz.lipinski, Commented Mar 2, 2015 at 1:46

funseiki · Accepted Answer · 2015-03-08 23:50:05Z

5

Here's a gist of my current solution.

On the Parse side of things I send in an http request that looks something like the following:

// Within a /verify_credentials webhook
Parse.Cloud.httpRequest({
    method: 'GET',
    url: req.get(headers[0]),
    headers: {'Authorization': req.get(headers[1])},

    success: function(httpResponse) {
        var obj = JSON.parse(httpResponse.text);
        res.status(httpResponse.status).send("success");
    },
    error: function(httpResponse) {
        res.status(400).json({
            error: 'Unable to make a twitter request'
        });
    }
});

On the Android side of things, I send an http request to the Parse server with the Parse session information within the headers:

    TwitterAuthConfig authConfig = TwitterCore.getInstance().getAuthConfig();

    // Cast from AuthToken to TwitterAuthToken
    TwitterAuthToken authToken = (TwitterAuthToken)session.getAuthToken();

    OAuthSigning oAuthSigning = new OAuthSigning(authConfig, authToken);
    // First value should be the location we're querying to twitter. 
        // The second is the actual validation information
    Map<String, String> authHeaders = oAuthSigning.getOAuthEchoHeadersForVerifyCredentials();
    try {
        cloud.verifyCredentials(
                authHeaders.get("X-Auth-Service-Provider"),
                authHeaders.get("X-Verify-Credentials-Authorization"),
                session.getId(),
                callback);
    }

answered Mar 8, 2015 at 23:50

funseiki

9,56710 gold badges41 silver badges62 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Felker Over a year ago

How is this working out? Have you launched, and if so, how is this solution holding up?

funseiki Over a year ago

@Felker this worked fine for the app we working on. We've switched to app engine since so I'm not sure how effective this solution would still be. I believe Parse is closing down, but it might work with their Nodejs library

Collectives™ on Stack Overflow

Digits Authentication with Parse Server

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related