Mobile API

[amardeepranu]

Hi! I'd like to use blitzjs as my backend + web but I'd also like to use it as a secure mobile API using oauth with a native iOS/Android app. Is there a way to integrate the current auth strategy to be used with the mobile API? Rails has devise + doorkeeper for this, was wondering if theres something similar for Blitz or a low/medium effort way to get the same functionality without rolling my own oauth implementation.

[flybayer]

@amardeepranu hey! This is totally possible, just needs someone to figure it out! This is a good idea for a feature to add directly to blitz.

[rizrmd]

maybe we can get inspiration from next-auth since it’s the best implementation for oauth in nextjs imo.

[firrae]

Specifically the Rails equivalent to making this work is Devise-JWT. Devise alone is Cookie/session only, Doorkeeper I've honestly never gotten to work properly, so I can't speak on it.

The most common flow I've seen is below:

1. Mobile app directly logs into the auth provider (Google, Facebook, Twitter, etc.) and gets a JWT from them.
2. It sends that token to Blitz on each call and Blitz confirms it's a valid token from that provider. This would once again require extra logic in the session management layer of course. At this point there's a fork in possible logic:
   a) Blitz confirms the token and responds with it's own which it then verifies from then on.
   b) It always verifies the raw provider token. This would likely require some sort of header specifying what the provider was so the correct logic can be run.
3. Once confirmed the user needs to be set in the context for this API call.
4. The call is resolved and the exchange is complete.

A couple months ago I initially looked at the potential options at how to do this and was stuck on step 2. Browser auth is supported in some JS App providers, but it still doesn't seem that well implemented, and I have found the documentation to not be as clear as I would like and in Expo I see a clear weak point in security with them proxying requests as the answer. AppAuth seem popular, but I haven't played with it and from the documentation I'm also not sure how it actually works and if I'd trust it.

The B method is the one I kinda like more. Most of the providers I've seen offer direct JWTs to mobile apps, and those could be verified by the standard JWT verification logic we've been using in Node for years. In this case most providers offer the logic behind verifying their JWTs. Some offer API endpoints to help with getting their current keys needed to verify tokens. The issue here is each user would need to know the UUID the provider identifies them as so they can be looked up. Off the top of my head I'm not sure Blitz does this already, but could be tracked I guess.

If someone else knows of a way to do this that I'm unaware of I'd love to know. I have a project right now that I would have loved to use Blitz on for the web client, but it requires mobile apps and as such this is basically a blocker from the start. I'd love to see some sort of answer for this. I love the idea behind Blitz, but this is something that until web phone apps become more accepted (the world still prefers "native" apps) would be a differentiator in my mind.

[firrae]

@flybayer did a solution ever evolve to allow mobile apps to auth against the Blitz API? I'm once again looking at a project where Blitz would be a good fit, but it requires a mobile app but I can't seem to find a solid answer.