I am experimenting with third party login, using Twitter and Facebook.
After getting access token from these parties, and confirming its validity, I then issue my own JWT token thats used within my application cluster. Only thing I use the 3rd party token for is getting an email address and user id, I don't interact with the social network in any other way,except for revalidation.Basically its just so that users dont have to fill in new password.
I have several services, each on different subdomain. These services somewhat adhere to philosophy of microservices, and each is responsible for narrow scope of functionality (e.g. UAC, bussines entity repo etc. )
The sole purpose of the JWT token is to decrease auth check complexity among the other services, which shouldn't be Oauth provider aware. I also dont want to identify which provider they chose in the publicly visible JWT.
I installed third party (offically approved) SDK on the UAC microservice, with which I'm interacting through AJAX request.
EDIT: Updated flow, for better clarity
- From presentation layer : require authorization URL from UAC module. On the UAC module side, the SDK handles CSRF token creating, and sadly, storing as well (at least the FB SDK does). The CSRF token is set into session.
- Redirect user to FB auth page, user authorizes, gets sent back to my presentation layer with a CSRF token to compare
- This is where the CSRF check SHOULD happen, but the original token is not set in the current session, instead is in the UAC module
- From presentation layer - server side : grab Oauth token and CSRF token, send it to UAC module
- This is where the CSRF check COULD happen, but server-server communication doesnt have the session. This is where i skip the CSRF check by tricking the SDK to accept whatever CSRF token just came in
- Validate the Oauth token, exchange for long lived one, fetch users data, create user entity in my database, issue JWT, done.
- JWT is set from Presentation layer - server side with SetCookie. This cookie users HttpOnly and Secure ( but thats not really the issue here )
In simplest terms: I want to achieve the same functionallity as regular Oauth with these providers, but I need to split the process among two subdomains. Neither of these should have PHP session if possible, except for the brief moment of FB SDK forcing me to use one.