I'm creating an API server (a gateway) with two restrictions in mind:
- It has to be sessionless (no session id in a cookie or anywhere, no Redis or anything like that)
- I have to use an implicit grant provided by a third-party identity provider with OAuth 2 like protocol.
Normally people are generating a nonce in order to prevent a replay attack. Nonce is stored in a session and sent to the identity provider. The identity provider, eventually, returns it back to the API server through a callback. The server has to retrieve the nonce from the current session and compare it with the one received through the callback. All nice and sweet if you have a session. I don't.
What is a widely accepted solution for this?
Would it be good if I, on my (API server) side, generate a nonce, create a JWT with this nonce, put a short expiration (e.g. 5-10 minutes), sign it with my secret and send it as a nonce to the identity provider? Then, in the call back function, I'll retrieve the nonce (JWT) and validate it's expiration, signature and other params. And then, if everything is fine, accept the rest of the callback payload.