Leveraging Dwolla OAuth for User Authentication

Dwolla Forms, a Dwolla Labs project, uses Dwolla’s OAuth API to authenticate users rather than the standard email / password login scheme most web applications use today. Your app can too!

By relying on a third party like Dwolla to authenticate your users, you outsource the responsibility of username and password storage, retrieval, and verification. This lets you leverage all the hard work we’ve put into building a secure login system, for free! Of course, relying on a third party requires trust and faith in the accuracy and security of this third party authority. Rest assured, we’ve got our data locked down. (read more about security at Dwolla)

By lowering the amount of sensitive information you hold, you become a less tasty target for attackers. As another consequence, you’ll save your users from having to remember yet another username and password combination.

Overview

We can implement authentication via Dwolla OAuth in three easy steps:

1. Obtain authorization to access a Dwolla user’s account information via OAuth
2. Retrieve the user’s unique Dwolla ID using the Dwolla REST API’s Account Information endpoint
3. Authenticate the user based on their Dwolla ID.

When a user signs up via OAuth for the first time, we retrieve and store their Dwolla ID with their user data. In the future, when that user attempts to sign in again, we point them to OAuth with Dwolla, and then we ask, in effect, “Hey Dwolla, what’s the Dwolla ID of the user I just redirected to you?” From there, we look up the corresponding user by their Dwolla ID and generate a login session for them.

Sample code!

Let’s look at how that works with some sample Node.js code. We’re using the express.js web application framework and nanek's node-dwolla package.

First, we’ll start off by creating a route which initiating OAuth:

    app.get('/auth/dwolla', function(req, res) {
      var authUrl = Dwolla.authUrl(redirectUri, "AccountInfoFull");
      return res.redirect(authUrl);
    })

After the user logs in and authorizes our Application, they’ll be returned to /auth/return, which is handled here:

    app.get('/auth/return', function(req, res) {
    var code = req.query['code'];
    $.waterfall(
      [
        // Exchange code for token
        function(callback) {
          Dwolla.requestToken(code, redirectUri, callback);
        }
        // Get user info
        , function(token, callback) {
          Dwolla.setToken(token);
          Dwolla.fullAccountInfo(function(err, user) {
            if(err) { return callback(err); }
            return callback(null, user);
          });
        }
        // If user is new, create a new user with Name and Dwolla ID returned by fullAccountInfo
        // otherwise, if they already exist, return the existing user object.
        , function(user, callback) {
          db.User
            .findOrCreate(
              {
                dwolla_id: user['Id']
              }
              , {
                name: user['Name']
                , dwolla_id: user['Id']
              }
            )
            .complete(function(err, user) {
              if(err) { return callback(err); }

              // log user in:
              req.session._user = user;
              return callback(null, user);
              }
            })
        }
      ]
      , function(err, results) {
        if(err) {
          return res.send('oh no!');
        }
        return res.render('nextpage');
      }
    )
  })

In this route, we first extract the verification code we get upon user redirect and exchange it for an OAuth token, thus completing the OAuth process. Then, we retrieve the user’s Dwolla account information with Dwolla.fullAccountInfo().

From the user object we get back, we’ll find an existing user account based on the user’s Dwolla ID, or create a new one, with the given user’s name and Dwolla ID. Finally, we’ll log the user in by attaching their user object to the current session and send them off to the next page.