Correct way to use "Sign in with LinkedIn" to identify users on my website?
linkedin-api
Solution
I'll answer it myself. It turns out that you can optionally ask the LinkedIn API to also return a cookie which contains a signature. Return this cookie to your back end server over an HTTPS connected and there you can validate the signature against your own API key. Voila - you have proven that this is a valid user and you have proven that the users login actually came from LinkedIn rather than being spoofed.
Problem
I am trying to understand "Sign In with LinkedIn". I seem to only be grasping part of the picture. As I understand it, a user signs in with LinkedIn on my website, and LinkedIn returns a unique user identifier to my website. Somehow I then use that identifer on my website to identifty the user. But I don't understand - once the end user has seen the identifier, what is to prevent them using directly from then on and never logging in again via LinkedIn? Must the returned user ID be kept secret, or can it be displayed publicly, for example in a URL? Also, what is to prevent someone finding someone else's user id and then using it to access my site? Seems like I'm missing an entire slab of understanding of how the user id returned from LinkedIn is meant to be used, and what issues there are relating to security. Can someone explain please? Thanks