I have an existing signup/login system: a user enters an email and password. The password is hashed. I store it in a database.

When a user logs in, they entire their email and password. The password is hashed, and I look up the email in the database and check that the email matches. If it does, they are logged in.

I want to add a system to let users login with a 3rd party OAuth, such as GitHub. I have that setup, but I am unsure what data to store in my database.

I was thinking I take their GitHub email as the email and then use the access token for their GitHub as the password (so I would hash it and store it.)

I think this would work, but I am worried that the access tokens could change meaning they would be locked out of their account.

If I shouldn't be using the access token as a password, what should I be using? I need to store the user's email on my database but that requires a password currently, which I can't get if they use GitHub login.

(Note that when the user logs in, I call my backend to generate an access token (JWT) which I can use to require their user details and then store it in local storage. I'd like to then be able to do the same thing with with GitHub or whatever.)

CodePudding user response：

oAuth is usually for authorization. Meaning, you get an access token from the authorization server, the resource server validates it and let the user access to the data.

In your case, you "do not really need" the access token - you want to use oAuth just for the authentication. Web-applications (like StackOverflow) does this to "save the trouble" of handling the authentication flows. Meaning, if I write a secured application, I need to implement somehow the create account flow, login flow, forgot password, etc. When you use a 3rd-party authentication, you save this trouble.

However, you application does need some user-id to perform actions; so you must create a user-id in you app when a user appears for the first time. Since then, you do not need to worry about password-expiry, forgotten-password and even not for the login. When the user logs-in, you get the access token and all you need to do is to get yours app' user-id from it.

Thus, I do not see a reason why you need to store a 'password', or the access token.

Hope that makes sense.