Sinatra + omniauth + Android, tips

Question

I am developing a Sinatra application for which I would like to use OmniAuth. So far, I have something similar to this for a web application:

http://codebiff.com/omniauth-with-sinatra

I want the web application to be usable via Android phones, which will use the API, authenticating with a token. The development of the API seems to be well covered here:

Sinatra - API - Authentication

Which is not clear, now I can organize the login procedure. Presumably this would be as follows:

• The user chooses which service to use, for example. Twitter, FaceBook & c., Using a button in an application on an Android device.
• The Android application opens a web view to enter the web application.
• The token is somehow created, stored in the web application database, and returned to the Android application so that it can be stored and used for subsequent API requests.

I do not quite understand how point 3 can be controlled - does anyone have any suggestions?

Answer 1

Like no one seems to have any suggestions, this is what I have come up with so far. I do not think this is very good.

I added an API key to the user model, which is created when the user first authenticates:

class User include DataMapper::Resource property :id, Serial, :key => true property :uid, String property :name, String property :nickname, String property :created_at, DateTime property :api_key, String, :key => true end .... get '/auth/:name/callback' do auth = request.env["omniauth.auth"] user = User.first_or_create({ :uid => auth["uid"]}, { :uid => auth["uid"], :nickname => auth["info"]["nickname"], :name => auth["info"]["name"], :api_key => SecureRandom.hex(20), :created_at => Time.now }) session[:user_id] = user.id session[:api_key] = user.api_key flash[:info] = "Welcome, #{user.name}" redirect "/success/#{user.id}/#{user.api_key}" end 

If authorization works, api_key is delivered in an Android application, which, presumably, will store it on the device somewhere:

 get '/success/:id/:api_key', :check => :valid_key? do user = User.get(params[:id],params[:api_key]) if user.api_key == params[:api_key] {'api_key' => user.api_key}.to_json else error 401 end end 

All API calls are protected as in the link in my original post:

 register do def check (name) condition do error 401 unless send(name) == true end end end helpers do def valid_key? user = User.first(:api_key => params[:api_key]) if !user.nil? return true end return false end end 

For general use, I will only allow SSL connections to the server. Any suggestions for improvement are welcome.