title: How do I persist a session using OAuth 2.0 after authorization through a third party service?
body: <p>I'm implementing an OAuth 2 based authorization model for an application I'm developing. I'm offering end-users the ability to login with Facebook or by setting up an email/password account with my API. The email/password authentication is straightforward using a password grant. I'm looking for help with the Facebook login flow.</p>
  
  <p>My application is a single-page application that consumes a JSON API (my "resource server"). I'm using the Facebook JavaScript SDK to authorize the web app to access the end-user's email address.</p>
  
  <p>When a user attempts to login with Facebook, the entire process takes place between Facebook and the web application. As a result, my API can't trust the Facebook authorization token until it verifies the token with Facebook's OAuth server.</p>
  
  <p>As of right now I'm passing the Facebook <code>accessToken</code> to my API, which then verifies the user's authorization with Facebook via a server-to-server call of the "me" graph API. Here's an illustration of my current setup:</p>
  
  <p><a href="https://i.stack.imgur.com/btRUZ.png" rel="noreferrer"><img src="https://i.stack.imgur.com/btRUZ.png" alt="My current OAuth flow"></a></p>
  
  <p>So, at this point, I have a Facebook access token and an email address. I need to persist my session between my API server and the web application. What is the standard method of persisting the session at this point?</p>
  
  <p>From reading the OAuth documentation, it seems that this is the type of situation that calls for an "implicit grant" between my API server and the web application, but that grant type is not available in the <a href="http://oauth2.thephpleague.com/" rel="noreferrer">OAuth package I'm using</a>. Also the author of the package <a href="https://github.com/thephpleague/oauth2-server/issues/249" rel="noreferrer">says implicit grants are "very insecure"</a>.</p>
  
  <p>My other thought is that I can create a random client ID and client secret, then pass them back to the web app so it can request an access token via a credentials grant. This seems illogical to me. Why wouldn't I just create an access token and send it back to the client to use directly?</p>
  
  <p>I should be maintaining authentication directly between my web app and API server after the initial authorization from Facebook, is that correct?</p>
  
  <p>I realize I could just generate a random password and send the user an HTTP Basic token, but I'd prefer to use OAuth unless there are no benefits.</p>