I've been reading up on this for months and it seems like the whole thing could converge on what I'm summarizing below. I'm trying to arrive at the most ideal:

  • OAuth2
  • OpenID Connect
  • SPA / Mobile Client
  • JWT

Solution that has banking level security quality as the above component are concerned. So this is what seems to make sense.

  • Use the Authorization Code Grant without using server side sessions and cookies since this OAuth flow is more secure than the implicit flow.
  • Do not create server side sessions or cookies (Besides perhaps remember me cookies to identify whether the client has been authenticated before). This is better for scaling and overall simplicity.
  • Return a JWT / OpenID connect token to the client so that the client can use it to make API requests and for making authorization decisions within the client. (I think this is what the OAuth2 hybrid Authorization Code Grant / Implicit flow is?). Store the JWT / OpenID connect token in the clients session storage.
  • Have short lived JWT tokens and also offer up refresh token until the user logs out. The client would automatically receive refresh tokens unless it times out / the client side session expires or the user logs out.
  • On logout (Or timeout), remove the token from browser session storage.

Is any of this crazy / does it sound reasonable? It skips over invalidating tokens, but it seems ok to do this if the tokens have very short life times and the client can get refresh tokens. I'd like to implement this using Spring-Boot / Spring Security and Angular 4/5 and I'm wondering if I missed anything obvious or perhaps there is an even simpler approach that does not sacrifice/lower security?

Also do you think this would pass "Banking" level security standards check?

  • Can you explain what you think "Banking level security standards check" means. Are you referring to PCI-DSS, other standards such as ISF' SoGP or NIST's relevant sections, or something else?
    – Rory Alsop
    Oct 8 '17 at 8:32
  • I'm not really referring to any specific standard ... more of a general feeling type of response - if you were a security developer for a bank would you recommend this as a reasonably safe approach, or would it need to be tighter because ...
    – Ole
    Oct 9 '17 at 0:23
  • This question is related to a question I asked: security.stackexchange.com/questions/204858/… (50 point bounty!)
    – Andy N
    Apr 25 '19 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.