Authenticate using OAuth I'm working on wrapping my mind around decoupled Drupal 8 while using an AngularJS app for the frontend. What I am trying to do is to allow a user to authenticate with my D8 site using their username and password, and then provide them with an OAuth token which will allow them to continue to make requests. 

What is the correct flow in order to allow this type of authentication?
Is this the correct way to go about things? From what I understand basic auth isn't nearly as secure as OAuth, so I'd rather stay away from that.

I've been messing around with the simple_oath module and jDrupal, but they don't seem like they are quite "there" yet. Any suggestions?

Part of the problem I'm having, is figuring out where the OAuth modules end, and where my module needs to begin. 

[Edit] I've heard conflicting things about cookie/session authentication. My end goal is to turn this into an app. Does cookie/session storage work with a mobile environment?

Thanks!
I think you're desire to use Oauth is justified. However, if you have no other options, you can use Cookie authentication. I have used it before and have heard of people using it as well. Here are some things to keep in mind and you'd be good to go with Cookie auth with your mobile application:


You will have to increase the session timeout time to a long period, say, 1 year or more. This means that after the period, the user would have to be asked to login again. Alternatively, you can refresh the Cookie with each request. You will need to:


Change session settings in PHP settings
Change session settings in Drupal settings

You will have to authenticate the user and then have a mechanism to persist the user's Session ID using a Set-Cookie header.
You will need to have a mechanism to handle sign-in failure when the session cookie has expired. When the session expires, you can send the user to the sign-in page again (maybe with the username field pre-populated) and ask then to sign-in again.
Since leaving a session long open poses to be a security threat, you might consider using other mechanisms like CSRF tokens.


Note: If you are in the mood for experimentation, you can also look into JWT authentication. Also, if you expect to have a huge user-base, you might consider a service like Firebase for storage.

Hope it helps. Happy coding!