I understand that OAuth2 was designed to delegate authorization grants to specific resources, it alone is not an authentication protocol. However, the
passport-github README states,
This module lets you authenticate using GitHub in your Node.js applications. By plugging into Passport, GitHub authentication can be easily and unobtrusively integrated [...]
The GitHub authentication strategy authenticates users using a GitHub account and OAuth 2.0 tokens.
passport-github in my HelloAPI, end users would be directed to GitHub's authorization server to start the 3-legged
- First the user authenticates with GitHub and grants limited access to HelloAPI.
- GitHub redirects the user-agent (browser) back to HelloAPI using a pre-registered
redirect_uri. The redirection URI includes an authorization code, and optionally, a
stateparameter for cross site request forgery detection.
- HelloAPI quickly exchanges the code for an access token, using the
client_secretas a means to authenticate HelloAPI with GitHub. (Here too, I should include a
- And finally, HelloAPI uses the token to grab whatever GitHub profile is associated with that token.
Here we assume that the token was not created by some other client and subsequently replayed to HelloAPI as an attack to impersonate a GitHub resource owner. By checking the
state parameter, I think that is a safe assumption, but https://oauth.net/articles/authentication/ warns against doing so:
OAuth APIs do not provide any mechanism of audience restriction for the returned information. In other words, it is very possible to take a naive client, hand it the (valid) token from another client, and have the naive client treat this as a "log in" event. After all, the token is valid and the call to the API will return valid user information. The problem is of course that the user hasn't done anything to prove that they're present, and in this case they haven't even authorized the naive client.
So this is my hesitation in using
passport-github: It uses OAuth2 tokens for authentication which is exactly what the experts warn against. Including a
state parameter seems to secure this server-to-server
authorization_code flow, but I'm not sure.
What am I missing? Is
passport-github authentication secure, or is there any way to make a "Sign In With GitHub" feature secure?
/access_tokenendpoints. (3) I agree. HelloAPI would create a token once the OAuth flow is complete - assuming it is safe to authenticate end users with passport-github.