I've created a Flask RESTful API which requires an email / password and Facebook login flow. This will probably need to be extended in the future to support more social logins.
I've chosen to authenticate users using JWT.
Since I want to support multiple types of login flows, I figured I need to define a custom grant type for each type of login.
I took a look at Flask-JWT, but this doesn't seem to support custom grant types, not even for refresh tokens.
Because I couldn't find another Flask JWT implementation, I had to write my own. My code works, but I have some concerns, considering there isn't a Flask plugin that fulfils my requirements.
- Is it a good practice at all to define custom grant types? rfc6749 states it is supported.
- Did I implement the email / password / refresh token authentication flow correctly (Figure 1)?
- Did I implement the Facebook authentication flow correctly (Figure 2)?
- I'm using uuid4 to generate refresh tokens. Is this a good idea?