Thank you very much Frédérik for digging up all that info for me, and
thanks to Caleb for letting us know it won't work under Chrome OS.
I guess I have to use an OAuth or OpenID flow, and in that case I was
thinking of using OAuth 2.0.
In my app when the user installs the application on another
Chromebook, I need fetch his/her settings from my server.
So first I use the OAuth flow to get my access token, then I query one
of Google's API to get the user's email address, and hopefully at the
same time get its first name (probably its last name too :).
As I understand it there is no "accounts" scope, the "feeds" one seems
the less obtrusive and sufficient to let me tie the user's Google
account to my app.
At this stage, I am sure the user is who they say they are.
Then I have a bit of a problem because I never obtained a permanent
OAuth access token (expires_in=4301).
Do I have to pass the short-lived access token for each request to my
server, make my server check if the access token/email combo is
correct, tell the user to get another token if it expired, etc.?
Seems like I need to implement at least once a server-side flow, then
my server can generate my own encrypted key which will act as
permanent token, and store that on the client's side.
Since it's tied to the user's email address and it's also stored on my
server, I can use that for each request the user makes.
Any issues in this process, security or others?
Any recommendations on using OAuth 2.0 or on the whole flow of my app?
And if you have any links that explain how to implement JavaScript
OAuth 2.0 flow (other than
http://code.google.com/apis/accounts/docs/OAuth2.html#CS),
don't hesitate to shoot them over ;)
Thanks a lot!