Should the access token in oAuth be generated ever

问题:

I've implemented the oAuth in php (currently for twitter) and as I've read in several tutorials you should store the access token in db for future use. However I don't see how you know if you have the access token stored for a particular user to decide if you should pull it out of the db or regenerate it. Here's a flow describing my question:

First time user signs in:

• get request token
• send user to provider's authentication page
• user returns to callback url with oauth token and oauth verifier
• get access token
• save access token/user_id/screen_name on db for future use

User returns 10 minutes later:

• access token is still in server session vars if user didn't log out. else, repeat process.

User returns 1 month later:

• get request token
• send user to provider's authentication page
• user returns to callback url with oauth token and oauth verifier
• ( at this point I only have oauth tokens, how can I know if the user has previously logged in with twitter and pull their access token from db? )
• if it is the user's first loggin, generate access token.

The main workflow for oAuth is clear, however it is not clear how to handle returning users and which data should be stored or not.

A million thanks!

回答1:

You should not regenerate token for each access. Generate it only when it's expired. I've build twitter application using OAuth. Here my flow:

1. when user login, I will check if they have token in DB

   1.1. If it's not exists, authenticate them and then store and use the resulting token

   1.2. If it's exists, use it.

   1.2.1. If twitter doesn't complain, then the token still valid, use it.

   1.2.2. If twitter complained, then the token is expired. Return to 1.1.

   1.2.3. If after x retry twitter still complained. Something wrong, notify admin!

Here's the graphical explanation:

回答2:

The only thing I believe is missing here, is generate a random (long and unguessable) user id first time the user joins the system, and store it forever. this way you can tell who's taking the actions