Node JS Theory - Implementing API V1

[Worldofjimmy]

Hi,

 

I would like to discuss best practice for implementing the API the correct way.

I have not been working with APIs before but I was thinking of this way to implement it.

 

Scenario one someone enters the homepage

Spoiler

 

Middleware  -  Check if a token is stored in the session, if not get a token.

Middleware  -  Check if token is expired, if expired refresh token stored in session

If token stored in session and is not expired proceed with request.

 

 

Scenario two user checks leaderboard.

Spoiler

 

Middleware  -  Check if a token is stored in the session, if not get a token.

Middleware  -  Check if token is expired, if expired refresh token stored in session

If token stored in session and is not expired proceed with the request

 

 

For user authentication to login on the website do all the accounts need to have access to the API?

 

How would you implement it? 

[jcsnider]

You should never provide individual users with API access. Instead your NodeJs app will have an API account and it will use that to validate passwords as your users login and your app will then do its own permissions for each user so you can determine who can access what.  Your NodeJs app would send any API calls that the users need for them.

 

[Worldofjimmy]

On 9/14/2019 at 7:45 AM, jcsnider said:

You should never provide individual users with API access. Instead your NodeJs app will have an API account and it will use that to validate passwords as your users login and your app will then do its own permissions for each user so you can determine who can access what.  Your NodeJs app would send any API calls that the users need for them.

 

 

Okay I understand. Use NodeJs app account for API.

 

So in theory - Login function

 

The user provide with username and password.

 

API account takes the credentials and check with API

https://docs.freemmorpgmaker.com/api/v1/endpoints/users.html#validate-password

 

Depending on the response, if the response is "Message" : "Password Correct"

Fetch users data and then redirect user to his profile page.

 

 

[jcsnider]

Yup

[Worldofjimmy]

On 9/16/2019 at 8:03 PM, jcsnider said:

Yup

 

 

The Refresh token, Will it expire at the same time as access token?

 

is there a smart way to build a function to check if access token has expired?