Working with Node, Express, and Passport.

Okay, so my team and I are building a REST API for a dual-sided marketplace type application. We have already set up a basic LocalStrategy for email and password login.

**We want to make the API user-agent agnostic, so we can use the API via web, Android, or iOS.**

But where we are getting confused is with the FB login flow. The question is, what exactly goes on behind the scenes in Passportjs. We have looked into the 'passport-facebook' and 'passport-facebook-token' strategies, and can't really decide which one to go with.

This is my current understanding of the flow:

![Passport-token](https://i.imgur.com/EM5r3Wu.jpg)

![Passport-facebook](https://i.imgur.com/wnbPffb.jpg)

If this is correct, am I better off having the client get the access\_token from FB then sending it to me, or just letting FB handle it via redirects and the callback URL?

Passport-token:

```
passport.use('facebook-token', new FacebookTokenStrategy( {
    clientID: 'xxx',
    clientSecret: 'xxx'
}, function(accessToken, refreshToken, profile, done) {
    // asynchronous
    //console.log("into passport auth");
    process.nextTick(function() {
        User.findOne({'facebook.id': profile.id}, function(error, user) {
            console.log("user is " + JSON.stringify(user));
            console.log("profile is " + JSON.stringify(profile));

            //do user creation stuff etc.

            return done(error, user);
        });
    });
}));

authRouter.post('/facebook', passport.authenticate('facebook-token'), function (req, res) {
    console.log("into controller");
    if (req.user){
        //log the user in since they successfully authenticated with facebook.
        req.login(user);
        res.status(200).end();
    } else {
        res.status(401).end();
    }
});

```

Passport-facebook:

```
passport.use('facebook', new FacebookStrategy( {
    callbackURL: "http://75.128.65.176:8080/auth/facebook/callback",
    clientID: 'xxx',
    clientSecret: 'xxx'
}, function(accessToken, refreshToken, profile, done) {
    // asynchronous
    //console.log("into passport auth");
    process.nextTick(function() {
        User.findOne({'facebook.id': profile.id}, function(error, user) {
            console.log("user is " + JSON.stringify(user));
            console.log("profile is " + JSON.stringify(profile));

            //do user creation stuff etc.

            return done(error, user);
        });
    });
}));

// Redirect the user to Facebook for authentication.  When complete,
// Facebook will redirect the user back to the application at
//     /auth/facebook/callback
authRouter.get('/facebook', passport.authenticate('facebook'));

// Facebook will redirect the user to this URL after approval.  Finish the
// authentication process by attempting to obtain an access token.  If
// access was granted, the user will be logged in.  Otherwise,
// authentication has failed.
authRouter.get('/facebook/callback',
    passport.authenticate('facebook', { successRedirect: '/',
                                  failureRedirect: '/login' }));

```

Any details/elaboration on how this flow actually works would be GREATLY appreciated!