I'm working on wrapping my mind around decoupled Drupal 8 while using an AngularJS app for the frontend. What I am trying to do is to allow a user to authenticate with my D8 site using their username and password, and then provide them with an OAuth token which will allow them to continue to make requests.

What is the correct flow in order to allow this type of authentication? Is this the correct way to go about things? From what I understand basic auth isn't nearly as secure as OAuth, so I'd rather stay away from that.

I've been messing around with the simple_oath module and jDrupal, but they don't seem like they are quite "there" yet. Any suggestions?

Part of the problem I'm having, is figuring out where the OAuth modules end, and where my module needs to begin.

[Edit] I've heard conflicting things about cookie/session authentication. My end goal is to turn this into an app. Does cookie/session storage work with a mobile environment?


  • I haven't used the simple_oath module. But I believe using cookies as authentication should be fine. I am using same in my current project. Jan 19, 2017 at 10:42

1 Answer 1


I think you're desire to use Oauth is justified. However, if you have no other options, you can use Cookie authentication. I have used it before and have heard of people using it as well. Here are some things to keep in mind and you'd be good to go with Cookie auth with your mobile application:

  • You will have to increase the session timeout time to a long period, say, 1 year or more. This means that after the period, the user would have to be asked to login again. Alternatively, you can refresh the Cookie with each request. You will need to:
    1. Change session settings in PHP settings
    2. Change session settings in Drupal settings
  • You will have to authenticate the user and then have a mechanism to persist the user's Session ID using a Set-Cookie header.
  • You will need to have a mechanism to handle sign-in failure when the session cookie has expired. When the session expires, you can send the user to the sign-in page again (maybe with the username field pre-populated) and ask then to sign-in again.
  • Since leaving a session long open poses to be a security threat, you might consider using other mechanisms like CSRF tokens.

Note: If you are in the mood for experimentation, you can also look into JWT authentication. Also, if you expect to have a huge user-base, you might consider a service like Firebase for storage.

Hope it helps. Happy coding!

  • Thanks for the info. Good to know that cookies are a valid fallback if I can't get OAuth working. However, for now, OAuth is my authentication method of choice.
    – lukedekker
    Jan 20, 2017 at 0:12
  • @lukedekker I think that cookies are the correct method to use for decoupled Drupal. OAuth should be used when two different applications are trying to communicate. The authentication process of OAuth is long and requires the user to authenticate in your coupled Drupal site.
    – Eyal
    Jan 23, 2017 at 21:12
  • @jigar-mehta, no need to increase the timeout so much. just refresh it after each request ends.
    – Eyal
    Jan 23, 2017 at 21:14
  • @Eyal Thanks for the clarification. That hadn't been my understanding, but that makes sense now. I'll proceed with the cookie alternative. Thanks!
    – lukedekker
    Jan 23, 2017 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.