Python Flask and Google OAuth2 best practices
One option would be to require the user to register with your site after using OAuth2, but that's silly - you use OAuth2 to save that in the first place.
I'd just not save a password for this user. Why would you need it anyway? He's authenticating via OAuth2 as you said, and you need to ping the OAuth2 provider to verify the user.
I have a User model that has name, email, and password.
If a user signs up normally (through a form) the password stored in my db is hashed using passlib. Then, a token is generated and returned to the user's client. The token is a serialization of the player's id. To verify a player, he simply logs in with the token in the password field of a basic auth, and I simply deserialize the token and look up the player via the deserialized id. Also, a player may verify himself with his password.
The problem with using Google's OAuth2 is that a player does NOT set his password; he only sends the server a Google verified token, which the server sends to Google and obtains the user's email, name, etc.
How do I generate a password for the user? What am I supposed to do here?
My hackish workaround right now for Google OAuth2 user registration is simply: get the user's info from Google, generate a bogus password (which is hashed), and then generate the auth token for the user. Then, replace the bogus password with the auth token (which is hashed) and insert that as the user's password. The auth token is then returned to the user's client.
In other words, the auth token becomes the password. Right now my auth token's don't expire either.
Obviously this is a huge hack. What's the correct way to do this? Should I just ping Google every time a user needs to verify himself?