I'm new to OAuth (1 & 2), and I'm developing the server side of a mobile app that has a form with a "Fill Details from Google account" button. I don't need any long-range authentication\authorization.
From here (Listing 2) I understand that the server should have a controller that:
- When called without a
codein the query it will refer the user to get one (in an AuthorizationEndpoint such as: https://accounts.google.com/o/oauth2/auth). - When called with a
codein the query, the server will send an HTTP request to the TokenEndpoint (https://accounts.google.com/o/oauth2/token) to convert the code to an access-token (using a secret-key that is passed in the request).
At this stage, my server is suppose to be able to use the access-token to fetch the user's details from https://www.googleapis.com/plus/v1/people/me - and then return the details to the user's app, to fill in its form.
Am I (the server developer) allowed to be lazy and return the access-token to the user, instead of its details? i.e., let the user app make the request to https://www.googleapis.com/plus/v1/people/me.
This will allow, in the future, to give more power to the client app without changing the code on my server.
Thanks