I am hoping this is the correct stack exchange to be asking this, here goes.
I am building a new website whereby it implements its own custom login system. You simply register your username, email password etc. Then you're free to log in with the option of clicking "remember me" to save the hassle of logging in every time. For simplicity, let's call this the Custom Login System and an account a Custom Account.
However, I am very interested in integrating some 3rd party login systems via oAuth that are offered by the likes of Facebook, Google and Twitter.
My question is, is it feasible to have a mechanism whereby:
- you log in via Google, for example
- my script confirms the tokens and all that good stuff to ensure you authorised the login
- I then ask you to either link your Google account to:
- an existing Custom Account or
- a new Custom Account by asking to register one after logging in with Google
- once you've logged in to your Custom Account, I treat you like any other user except I assume the "remember me" option was ticked and set a cookie that logs you in from here on as if you were using a normal Custom Account the whole time.
This could essentially mean that I don't need to constantly query Google's servers, only during login. Then from there on, as long as they have a valid cookie they will stay logged in.
Is this possible? Are there any obvious flaws that I am missing out?