title: Authenticating with OAuth2 for an app *and* a website
body: <p>I'm developing a website that is primarily accessed via an app, and I want to use OAuth2 for user registration and authentication. Since it is an Android app I will start using Google's OAuth2 stuff, since it provides a decent UI on Android.</p>
  
  <p>Google states that <a href="https://developers.google.com/accounts/docs/OAuth2Login" rel="noreferrer">"You can choose to use Google's authentication system as a way to outsource user authentication for your application. This can remove the need to create, maintain, and secure a username and password store."</a> which is what I want to do. <em>However</em> when I go through all their examples and whatnot, I can only find stuff about having a website <em>or</em> an app authenticate a user against Google's services.</p>
  
  <p>And indeed, when I go to register my app ("client") with Google's OAuth2 there are options for website clients and "installed" clients (i.e. a mobile app) but not both. I can create two separate clients but I read the OAuth2 draft and I think there will be a problem, which I will now explain.</p>
  
  <p>Here's how I did envisage it working:</p>
  
  <p><img src="https://i.stack.imgur.com/3oDJt.png" alt="OAuth2 flow diagram"></p>
  
  <ol>
  <li>User asks MyApp to access his private data.</li>
  <li>App uses Android's <code>AccountManager</code> class to request an access token for Google's APIs.</li>
  <li>Android says to user "The app 'MyApp' wants access to your Basic Information on Google. Is this ok?"</li>
  <li>User says yes.</li>
  <li><code>AccountManager</code> connects to Google's OAuth2 server using the credentials stored on the phone, and asks for an access token.</li>
  <li>Access token (which follows the green lines) is returned.</li>
  <li><code>AccountManager</code> returns the access token to MyApp.</li>
  <li>MyApp sends a request to MySite for the user's private data, including the access token.</li>
  <li>MySite needs to verify the user, using the access token. It validates the token <a href="https://developers.google.com/accounts/docs/OAuth2Login#validatingtoken" rel="noreferrer">as described here</a>, with Google - "Google, is this token valid?".</li>
  <li>Now, what I <em>want</em> to happen is that Google says "Yes, whoever gave it to you is indeed that user.", but what I think will actually happen (based on the OAuth2 draft and Google's documentation) is that it will say "No way! That token is only valid for MyApp, and you're MySite. GTFO!".</li>
  </ol>
  
  <p>So how should I do this? And PLEASE don't say "Use OpenID" or "Don't use OAuth2" or other similarly unhelpful answers. Oh and I would really like to keep using the nice <code>AccountManager</code> UI rather than crappy popup <code>WebView</code>s</p>
  
  <h1>Edit</h1>
  
  <p>Provisional answer (I will report back if it works!) from Nikolay is that it should actually work, and Google's servers won't care where the access token came from. Seems a bit insecure to me, but I will see if it works!</p>
  
  <h1>Update</h1>
  
  <p>I implemented this pattern with Facebook instead of Google and it totally works. The OAuth2 server doesn't care where the access token comes from. At least Facebook's doesn't, so I assume Google's doesn't either.</p>
  
  <p>In light of that it is a very very bad idea to store access tokens! But we also don't want to have to hit Facebook/Google's servers to check authentication for <em>every</em> request since it will slow everything down. Probably the best thing is to add an additional authentication cookie for your site that you hand out when their access token is validated, but a simpler way is just to treat the access token like a password and store a hash of it. You don't need to salt it either since access tokens are really really long. So the steps above become something like:</p>
  
  <p>9. MySite needs to verify the user, using the access token. First it checks its cache of hashed valid access tokens. If the hash of the token is found there it knows the user is authenticated. Otherwise it checks with Google <a href="https://developers.google.com/accounts/docs/OAuth2Login#validatingtoken" rel="noreferrer">as described here</a>, with Google - "Google, is this token valid?".</p>
  
  <p>10. If Google says the access token is invalid, we tell the user to GTFO. Otherwise Google says "Yes that is a valid user" and we then check our registered user database. If that Google username (or Facebook id if using Facebook) is not found we can create a new user. Then we cache the hashed value of the access token.</p>