title: Creating a user creation / auth system for web and mobile that uses both email and facebook_id
body: <p>I am writing a user creation system for an iOS app and a web app (ie a user can be created from mobile app or web frontend) using Ruby on Rails. I am not interested in using a system like Devise.</p>
  
  <p>I haven't done this in a couple of years so just want to make sure that my ideas are current and make sense. </p>
  
  <p>Steps / Assumptions</p>
  
  <ol>
  <li>We will manage state between our server and the clients via a custom HTTP field such as "X-auth_token".</li>
  <li>They can be created either via email / password credentials or via facebook. </li>
  </ol>
  
  <p>In the case of email login, the user will just post the following json:</p>
  
  <pre><code>{
    user:{
      email:'joe@test.com',
      password:'testpassword',
    }
  }
  </code></pre>
  
  <p>I will be using Rails has_secure_password to hash the values.</p>
  
  <p>and will return </p>
  
  <pre><code>{
    user:{
      id:23,
      auth_token:'md5value',
    }
  }
  </code></pre>
  
  <p>For web, we will pass the auth_token as a cookie value. For the iOS app, the auth_token will be passed as a custom HTTP header field such as "X-auth_token"</p>
  
  <ol start="3">
  <li>In the case of facebook login, they will use the FacebookSDK, get scoped permissions from FB, and post </li>
  </ol>
  
  <p><code>
      {
        user: {
            is_facebook_login: true,
            fb_email: 'joe@test.com',
            fb_auth_token: 'abigvaluefromFB'
        }
      }
  </code></p>
  
  <p>On the server, we will ensure that they are passing a valid fb_auth_token credentials by 
  calling facebook with </p>
  
  <pre><code>def self.verify_facebook fb_auth_token
    result = Net::HTTP.get(URI.parse("https://graph.facebook.com/me?access_token=#{fb_auth_token}"))
    obj=JSON.parse(result)
    obj["email"]
  end 
  </code></pre>
  
  <p>and verifying that the fb_email sent in the initial request corresponds to the email provided back by facebook.</p>
  
  <p>Here's the steps with a corresponding diagram:</p>
  
  <p>STEPS</p>
  
  <ol>
  <li>oauth request to facebook, request email ONLY</li>
  <li>user approves, email and auth token come back</li>
  <li>send auth_token to our server; if a facebook auth'd client, set flag so that only can login via facebook</li>
  <li>verify with facebook that token is accurate</li>
  </ol>
  
  <p>Not worried about right now, if they change their facebook email, tough luck. If they login via Facebook and then want to login via email / pwd, tough luck.</p>
  
  <p>on our end, we will generate an auth_token (an MD5 string), and send it back to the client which now manages authentication. From that point on, we will send a custom HTTP header X-auth_token</p>
  
  <p><a href="https://i.stack.imgur.com/9pacH.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/9pacH.png" alt="enter image description here"></a></p>
  
  <p>We will respond with </p>
  
  <pre><code>{
    user:{
      id:23,
      auth_token:'md5value',
    }
  }
  </code></pre>
  
  <p>and the iOS app will write the auth_token to the keychain via <a href="https://github.com/kishikawakatsumi/KeychainAccess" rel="nofollow noreferrer">https://github.com/kishikawakatsumi/KeychainAccess</a></p>
  
  <p>Does the above scenario seem reasonable for user creation?  </p>