I'm working on wrapping my mind around decoupled Drupal 8 while using an AngularJS app for the frontend. What I am trying to do is to allow a user to authenticate with my D8 site using their username and password, and then provide them with an OAuth token which will allow them to continue to make requests.
What is the correct flow in order to allow this type of authentication? Is this the correct way to go about things? From what I understand basic auth isn't nearly as secure as OAuth, so I'd rather stay away from that.
I've been messing around with the simple_oath module and jDrupal, but they don't seem like they are quite "there" yet. Any suggestions?
Part of the problem I'm having, is figuring out where the OAuth modules end, and where my module needs to begin.
[Edit] I've heard conflicting things about cookie/session authentication. My end goal is to turn this into an app. Does cookie/session storage work with a mobile environment?