title: Adding OAuth 2.0 authentication to a RESTful API
body: <p>I have an API that requires authentication via OAuth 2.0. I originally anticipated using <a href="https://github.com/hwi/HWIOAuthBundle" rel="nofollow noreferrer">HWIOAuthBundle</a>, however from investigation this is more to do with hooking up 3rd parties into Symfony's security/auth mechanism and does not provide the required mechanism for validating OAuth 2.0 <code>Authorization</code> headers.</p>
  
  <p>I then found some information about <a href="https://github.com/FriendsOfSymfony/FOSOAuthServerBundle" rel="nofollow noreferrer">FOSOAuthServerBundle</a> which enables an application to become it's own OAuth 2.0 provider as well as providing the required security mechanisms to validate <code>Authorization</code> headers.</p>
  
  <p>However the problem is that I would like integrate the OAuth 2.0 provider (authorisation server) in an external application (which contains the user base) and not include it within the API. Which will provide some mechanism for performing the token verification against this external app via (another) RESTful API. </p>
  
  <p><strong>Points:</strong></p>
  
  <ul>
  <li>RESTful API requires OAuth 2.0 authentication.</li>
  <li>OAuth 2.0 authorisation server to be situated in a separate application.</li>
  </ul>
  
  <p>I feel I should use <a href="https://github.com/FriendsOfSymfony/FOSOAuthServerBundle" rel="nofollow noreferrer"><em>Implicit</em></a> grant and call the authorization server on each request to validate that the token is correct.</p>
  
  <p><img src="https://www.websequencediagrams.com/cgi-bin/cdraw?lz=dGl0bGUgSW1wbGljaXQgR3JhbnQKClVzZXItPkZvcnVtOiBHRVQgdG9rZW4AEQYADwlBY2NlcHRzIGcALwUAKAUtPlVzZXI6IE9BdXRoIFRva2Vu&amp;s=napkin" alt=""></p>
  
  <p><img src="https://www.websequencediagrams.com/cgi-bin/cdraw?lz=dGl0bGUgQXV0aGVudGljYXRlZCByZXF1ZXN0CgpVc2VyLT5IdWI6IFBPU1QgL2RlYWwvY291cG9uICsgT0F1dGggVG9rZW4KSHViLT5Gb3J1bTogdmFsaWRhdGUgdAAWBQARBQBABwANBSBWYWxpZAAmDQBOEQApDVN1Y2Nlc3MAXwZVc2VyAAoJ&amp;s=napkin" alt=""></p>
  
  <p>Is my thinking correct?</p>