Can't authenticate mobile client with node.js (using passport.js)

node.js, passport.js

Solution

Ok I had the same issue with facebook authentication. The easiest would be to only use the SIGNUP solution described in http://scotch.io/tutorials/javascript/easy-node-authentication-google but keep the google auth LOGIN on the client side. You authentication flow must be the same whatever client is using your app. (Browser, Android app, etc..)

So you would need to do the following things (well described here https://developers.google.com/accounts/docs/OAuth2UserAgent):

Set up the Google oauth2 login on the browser side (Using the JS SDK) using AJAX. The AJAX response should contain some kind of access token.

For every request made from either browser or native client, send the google access token in the Authorization header and check it with nodeJS it against https://www.googleapis.com/oauth2/v1/tokeninfo. This will give you the user ID (that you saved in you DB in the signup phase) and check the validity of the token.

So it hurst but you should get rid of the passport module that does the OAuth2 login on google. It turns out that step 2 can be done using nodeJS passport-google-token module! So this should not be too much work.

Good luck

Problem

I'm trying to build some CRUD application with node.js as a back-end API (express) and web-app (backbone) and mobile client (native android) as front-ends.(I'm node.js beginner) My server solution is based on the following great tutorial 'easy-node-authentication'. In my android app I have managed to get the user Google-Token after I completed the authentication step with Google Plus SDK.(mobile to google-plus directly request). I'm trying to understand and find right and elegant way to re-use a given google-token and authenticate again my android user through Google-Plus account to ensure the mobile client holds real token, then add a new entry (id, token, email, name) to my users table DB within my node back-end. The question is: what should be my next step in case I want to keep my back-end without changes? should I send a GET request with the token as a cookie to /auth/google? maybe to /auth/google/callback? another URL? Does this make sense at all? Please note: I'm aware to the fact the mentioned above 'easy-node-auth' solution is based on sessions and cookies. having said that, i'm still trying to understand if there is a convenient way to integrate both (android and node) as it works good for my web-app and node.

Original source