Webservices to create (Register) a new user

Question

I am planning to write client apps which connects to Drupal 7. I like to create new users through the app, have come across some literatures but I am not sure if the approach is secure and also whether it considers all possible use-cases.

The first link which I came across is this: https://www.drupal.org/node/1514312

I was able to configure endpoint and successfully post + create user. However, the problem with above approach is, it is not secure because any client app with the POST URL to create user can successfully register a user in the website.

I then followed this link: https://www.drupal.org/node/1871498 through which I created a OAuth authentication context. Below are the configuration details:

OAuth Context:
Context Title: App Name
Signature Method: HMAC-SHA1

The Service configuration:

Endpoint: create_new_user
Authentication:
OAuth Context -> Context created above
Default required authentication -> Consumer key (2 legged OAuth Authentication)
Resources ->
user -> create (Only create in CRUD Operation)
Action ->
user -> request_new_password & register

And I created a new user and provided the following role:

By enabling 2 legged OAuth authentication I make sure that only my authorized app with the consumer key and secret is able to access my endpoint successfully.

Using the following POST request I am able to create user successfully from the REST client:

Post Request URL: http://ExampleWebsiteBase.com/create_new_user/user/register.json

Post Headers:

OAuth:
OAuth oauth_version="1.0", oauth_signature_method="HMAC-SHA1", oauth_nonce="kXZ3iOtGqD7f350", oauth_timestamp="1450257992", oauth_consumer_key="Lq7r.........", oauth_signature="htvy........"

Content-Type:application/json

Post Body:
{
   "name":"SomeName",
   "pass":"reset123",
   "mail":"[email protected]",
   "status":"1",
   "roles":[
      "2"
   ]
}

I would need confirmation from experts that this configuration is secure and acceptable.

Questions:

• The user created in this process does not has to verify the email ID. How do I configure the webservice so that the user is not created in backend without verifying the email?
• How do I integrate Social login - Facebook, Twitter and Google for instance?

Answer 1

Try using the example reference below which displays the php code using OAUTH library with Services module.

Email verification needs to be done using the rules by adding condition to block user since using oauth it will be activated by default.

You can use the Facebook/Twitter end-point, consumer credentials(key & secret) replaced to Drupal services.

Reference: http://www.covenantdesign.com/blog/drupal-services-rest-server-and-3-legged-oauth