这是使用oauth2登录的正确工作流程吗？

Question

I need to implement LinkedIn login for one of client. Here is the workflow I am maintaining,

1. User will click on the "LoginUsingLinkedIn" button for the fist time.

2. The user will be redirected to linkedin authorization page and if he authorizes , I am requesting for an access token and stroing the same access token in the browser cookie. Now I am making call to linkedin to get the user info using this token.

3. Now lets say the user again come to the site after 2-3 days, then first I am checking if there is any accesstoken present in cookie.

   3.1: If accesstoken is present in cookie, I am making a call to linkedin to get the email id, if its successful then the accesstoken is valid and proceed further. If the call returns an error, then I am redirecting the user to linkedin authorization page agin.

   3.2: If the accesstoken is not present in cookie, the user will be redirected to linkedin auth. page.

This is the first time I am integrating oauth login to any site. Please let me if there is any issue with this approach.

Is it safe to store the accesstoken in the browser cookie? OR shall we store the authorization code in the cookie and obtain the accesstoken every time? I am not sure if it make sense. Please help.

Answer 1

There are libraries for this, even if you do not want to use it is good to take a look, in my point of view it is better to store the values in the session or database.

If you need only login, and is not doing things on linkedin like the user, just get authorization if the user is not logged in and save the user information, then when the session has expired or if the user has logged off, get the authorization again.

https://github.com/thephpleague/oauth2-linkedin

https://github.com/thephpleague/oauth2-client