I am experimenting with third party login, using Twitter and Facebook.
After getting access token from these parties, and confirming its validity, I then issue my own JWT token that's used within my application cluster. The only thing I use the 3rd party token for is getting an email address and user id, I don't interact with the social network in any other way, except for revalidation. Basically it is just so that users don't have to fill in new password.
I have several services, each on a different subdomain. These services somewhat adhere to the philosophy of microservices, and each is responsible for the narrow scope of functionality (e.g. UAC, business entity repo, etc. )
The sole purpose of the JWT token is to decrease auth check complexity among the other services, which shouldn't be Oauth provider aware. I also don't want to identify which provider they chose in the publicly visible JWT.
I installed a third party (officially approved) SDK on the UAC microservice, with which I'm interacting through AJAX request.
EDIT: Updated flow, for better clarity
- From the presentation layer: require authorization URL from the UAC module. On the UAC module side, the SDK handles CSRF token creating, and sadly, storing as well (at least the FB SDK does). The CSRF token is set into the session.
- Redirect the user to FB auth page, the user authorizes, gets sent back to my presentation layer with a CSRF token to compare
- This is where the CSRF check SHOULD happen, but the original token is not set in the current session, instead is in the UAC module
- From the presentation layer - server-side: grab Oauth token and CSRF token, send it to UAC module
- This is where the CSRF check COULD happen, but server-server communication doesn't have the session. This is where I skip the CSRF check by tricking the SDK to accept whatever CSRF token just came in
- Validate the Oauth token, exchange for long-lived one, fetch users data, create user entity in my database, issue JWT, done.
- JWT is set from the Presentation layer - server-side with SetCookie. This cookie users HttpOnly and Secure ( but that's not really the issue here )
In simplest terms: I want to achieve the same functionality as regular Oauth with these providers, but I need to split the process among two subdomains. Neither of these should have a PHP session if possible, except for the brief moment of FB SDK forcing me to use one.