I am trying to figure out the correct authentication strategy and concepts for a single page web application (SPA) featuring local login as well as 3rd party login (e.g. Google, Auth0). Unfortunately, quite a number of articles on the matter seem get the concepts plain wrong.
The basic idea is that the browser and server would use an authentication token (e.g. JWT), so the server can check if the user is logged in/authenticated.
Questions and different opinions start where this token should be stored in the browser and how it gets to the server:
- In a cookie using HttpOnly (and preferrably secure, i.e. SSL only): some articles claim that cookies require server state and are old style - but I think they are wrong here. If the cookie was just a session ID, that the server would need to know, then this might be true, but in modern days, the cookie is the authentication token, that the server can just check.
- CON: vulnerable to XSRF/CSRF, but there are fixes for that
- In LocalStorage/SessionStorage
- PRO: XSRF/CSRF not an issue
Am I missing something here?
(Note that it do not think it is an option to enter user-name and password, send it to my web-server and the web-server talks to Google/Auth0. This is a no-go, as users should not be entering their password for a 3rd party site on my web-site).
The token I get from the external site can be validated, yes, but what purpose does it serve:
- it is used to directly send requests to my server (replacing the token/cookie) from my server? That would break the cookie-strategy, as I cannot save the token in the browser.
- it is sent to my server (replacing username/password) and the server - after checking - returns its JWT as a token.
(Not sure if I need to store the external token at all.)
Any thoughts or guidance?