I am experimenting with third party login, using Twitter and Facebook.

After getting access token from these parties, and confirming its validity, I then issue my own JWT token thats used within my application cluster. Only thing I use the 3rd party token for is getting an email address and user id, I don't interact with the social network in any other way,except for revalidation.Basically its just so that users dont have to fill in new password.

I have several services, each on different subdomain. These services somewhat adhere to philosophy of microservices, and each is responsible for narrow scope of functionality (e.g. UAC, bussines entity repo etc. )

The sole purpose of the JWT token is to decrease auth check complexity among the other services, which shouldn't be Oauth provider aware. I also dont want to identify which provider they chose in the publicly visible JWT.

I installed third party (offically approved) SDK on the UAC microservice, with which I'm interacting through AJAX request.

EDIT: Updated flow, for better clarity

  1. From presentation layer : require authorization URL from UAC module. On the UAC module side, the SDK handles CSRF token creating, and sadly, storing as well (at least the FB SDK does). The CSRF token is set into session.
  2. Redirect user to FB auth page, user authorizes, gets sent back to my presentation layer with a CSRF token to compare
  3. This is where the CSRF check SHOULD happen, but the original token is not set in the current session, instead is in the UAC module
  4. From presentation layer - server side : grab Oauth token and CSRF token, send it to UAC module
  5. This is where the CSRF check COULD happen, but server-server communication doesnt have the session. This is where i skip the CSRF check by tricking the SDK to accept whatever CSRF token just came in
  6. Validate the Oauth token, exchange for long lived one, fetch users data, create user entity in my database, issue JWT, done.
  7. JWT is set from Presentation layer - server side with SetCookie. This cookie users HttpOnly and Secure ( but thats not really the issue here )

In simplest terms: I want to achieve the same functionallity as regular Oauth with these providers, but I need to split the process among two subdomains. Neither of these should have PHP session if possible, except for the brief moment of FB SDK forcing me to use one.

What I have tried so far : I changed the architecture a little, and instead of directly talking to UAC module from javascript, I bounce the request through server-side on presentation layer, and in that session I store the original CSRF token. When later the user comes back from FB auth page, i can perform the check. I still have to trick the SDK on UAC side, but that is after i verified the CSRF ( albeit not through the SDK itself ) Can I go ahead with this approach? Is this risky in any way, because I send the CSRF token between servers?

  • 2
    Which is the question? I don't fully understand which are the problem. Please, put numbers on your flow steps and mark from which you can jump and to which bypassing what. – OscarAkaElvis Feb 10 '17 at 13:57
  • Although your question seems a bit unclear, did you consider sharing Cookies between subdomains? Wouldn't that save a lot of complexity on each layer? – Sankalp Sharma Feb 12 '17 at 13:57
  • I edited the question so it's more clear hopefully. @SankalpSharma I am already doing that, thats not the issue here. – Slytherin Feb 13 '17 at 15:44
  • @OscarAkaElvis Edited. – Slytherin Feb 13 '17 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.