I want to implement authentication with a rails-react app. I am using OAuth with google as the authorization server.
I am using it to authenticate users on my rails api, not to get access to some of google APIs for a given user.
I want to use token based auth. I am using the gem omniauth to help with the process of exchanging the authorization token for the access token between the rails server and google.
Considering that the client (react) needs to always send a token in the header of every http request sent to the server, once I have an access token how do I verify this token sent by the client?
Here are my thoughts:
Verify the token on the server side
1 - How do I use the token to verify that the request coming from the client is coming from an authenticated user? Store in the db and compare it for every request? Query the OAuth authorization server every time to validate the token (If that is even possible) ? JWT ?
2- I understand that there are multiple flows to obtain a token from a OAuth provider. Omniauth seems to abstract this part of the token exchange with the OAuth provider am I correct?
Give the token to the react client
3- Once I get any token (whether its a JWT or a simple access token), I need to pass it to the react client, which is not secure as anybody could get a hold of this token and make a request to the api with a stolen identity. I think I missed something here as this doesn't make sense?
Thank you!