Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In creating a sort of "remote control" site, I'm wondering what the best way for authorisation is going to be.

The simplest example would be: User logs in on desktop - page 1 is displayed (controlled from mobile / page 2) User logs in on mobile - page 2 is displayed and controls page 1.

My initial thought is to use OAuth, as this saves me time in setting up the security side of things. I'm just wondering if there is going to be a conflict in the auth token being used twice.

Eventually the site will be moved to an app form, but I would like to get the site up first as a sort of test case.

Is this possible? Or is the mobile version going to have to be an app right out of the gate?

Any and all help is greatly appreciated. Thanks.

share|improve this question
up vote 0 down vote accepted

If you implement Oauth, you can't use authorization tokens twice.

The correct way to implement it would be to have the person log in using Oauth from each device. Each time they log in they would get a different set of authorization tokens. Then the Oauth server would give you a user id that you can store in your database to link the two device sessions together. That Id would be the same both times.

Here is how Oauth login might work using Facebook:

  1. Create an "app" on Facebook which will give you a client id and client secret: https://developers.facebook.com/
  2. Redirect the user to this url: https://www.facebook.com/dialog/oauth?client_id=MY_CLIENT_ID_FROM_FB&response_type=code&state=RANDOM_STRING_GENERATED_BY_ME&scope=public_profile,email&redirect_uri=http://mysite.example.com/login.php
  3. Facebook verifies the user and redirects them to: http://mysite.example.com/login.php?code=RANDOM_STRING_GENERATED_BY_FACEBOOK
  4. Your server requests this URL from Facebook: https://graph.facebook.com/oauth/access_token?code=RANDOM_STRING_GENERATED_BY_FACEBOOK&client_id=MY_CLIENT_ID_FROM_FB&client_secret=MY_CLIENT_SECRET_FROM_FB&redirect_uri=http://mysite.example.com/login.php&grant_type=authorization_code
  5. Facebook will send a response in name value format that contains an access_token and a state which you should verify is the same random string that you sent earlier.
  6. Your server requests this URL from Facebook: https://graph.facebook.com/me?access_token=ACCESS_TOKEN_FROM_FB
  7. Facebook will send a response encoded in JSON that contains information about the user including their email address and their facebook id.

When the user logs in from on a device, these steps need to be performed for that login. Then you have a Facebook id with which you can link the device sessions.

You could choose a different Oauth provider and the steps would be similar.

share|improve this answer
Thanks for the excellent answer Stephen. I'll give it a go with the various providers I'll be using - but the example you gave gives me enough information to work through these. – Robodashy Aug 28 '14 at 5:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.