title: Possible approach to secure a Rest API endpoints using Facebook OAuth
body: <p>I've been reading a lot about the topic but all I find are obsolete or partial answers, which don't really help me that much and actually just confused me more.
  I'm writing a Rest API (Node+Express+MongoDB) that is accessed by a web app (hosted on the same domain than the API) and an Android app. </p>
  
  <p>I want the API to be accessed only by my applications and only by authorized users.
  I also want the users to be able to signup and login only using their Facebook account, and I need to be able to access some basic info like name, profile pic and email.</p>
  
  <p>A possible scenario that I have in mind is:</p>
  
  <ol>
  <li>The user logs-in on the web app using Facebook, the app is granted
  permission to access the user Facebook information and receives an
  access token.  </li>
  <li>The web app asks the API to confirm that this user
  is actually registered on our system, sending the email and the
  token received by Facebook.</li>
  <li>The API verifies that the user
  exists, it stores into the DB (or Redis) the username, the token and
  a timestamp and then goes back to the client app.</li>
  <li>Each time the
  client app hits one of the API endpoint, it will have to provide the
  username and the token, other than other info.</li>
  <li>The API each time
  verifies that the provided pair username/token matches the most
  recent pair username/token stored into the DB (using the timestamp
  to order), and that no more than 1 hour has passed since we stored
  these info (again using the timestamp). If that's the case, the API
  will process the request, otherwise will issue a 401 Unauthorized
  response.</li>
  </ol>
  
  <p>Does this make sense? 
  Does this approach have any macroscopic security hole that I'm missing?
  One problem I see using MongoDB to store these info is that the collection will quickly become bloated with old tokens.
  In this sense I think it would be best to use Redis with an expire policy of 1 hour so that old info will be automatically removed by Redis.</p>