对于使用OAuth的现有网站感到困惑，但是现在我们向该网站添加了API

Question

I'm writing an API for our product and I'm trying to understand how some basic OAuth works with regards to mobile apps that might leverage our (to be created) api.

Lets imagine that our website currently allows a person to LogIn to our site via Twitter OAuth. On the callback from Twitter, our server retrieves the twitter OAuth result and if all good, then checks to see if this user already exists in our DB (eg. lets assume the Email is the unique key). If they don't exist, we create a new user.

Of course, we then log the user 'in', which means we create a cookie for them, for their browser.

So far - nothing new here. All normal stuff.

Now .. if we want to do this via an iPhone or Windows phone using their native language and the app's use our API, i'm not sure of the point where OAuth ends and our API takes over?

For example, lets pretend it's an iPhone app that takes advantage of our API. The iPhone app will try to authenticate the user against their Twitter cred's. Ok, fine. But when it callsback, it's back in the phone, right? Not our servers. So then the app needs to try and create a new user? So then the iPhone might try and call /api/CreateAccount . But this means -anyone- can call this api? And how does the website really know they have authenticated? Only because the app says so? What's to stop the person from creating a malicious app and calling our API by flooding it with new account creations? And what about authentication to api resources? Forms Authentication isn't available here. So do people use querystring authentication over SSL for api calls? How does the iphone authenticate with -our- server?

I'm so confused.

Can anyone please explain the differences and common practices people are doing these days when they have a website and an api .. and use OAuth as the authentication mechanism, please?

Answer 1

The naive app would call not CreateAccount , but VerifyAccount with twitter's oauth set of data so you site and API could verify it. The site would respond with a unique userID and your iOS app would use that as it's internal user id. More info .