1

My aim is to secure my stateless API and only allow the registered first-party clients (SPA) to consume my resources. There is not going to be any third party clients in my scenario.

I know Oauth 2 authorization with implicit grant type is recommended for public clients (in my situation, a SPA). I have read lots of things about that but I couldn't understand some points, so I'm asking for your help:

  1. Do you think Oauth 2 with implicit grant type is the best way to accomplish this? I know password credentials grant type is not safe for SPAs, because they can not maintain the confidentiality of a client secret. So should I go with Oauth 2 with implicit grant type?

  2. In Oauth 2, i can use the implicit grant type with auto approval, so taking the consent of users are not necessary anymore. But as i think of my SPA as a first party app, i don't want any users to redirect anywhere to login and get back to SPA page.

Do you think it is secure and sensible to enable http basic authentication for my API, so then my first party app would be able to get user credentials and add it to authorization header and sent to my Authorization server over SSL/TLS channel to authenticate and get access token?

If it is not appropriate, what do you recommend to achieve this goal?

  1. I want also unauthenticated users to consume some resources in my SPA; should I make those resources public for any client and any user (actually I don't prefer) or expect SPA to authenticate and authorize with a dummy anonymous user to get an access token with anonymous privileges to consume public API resources.

  2. For a Wikipedia-like website, how long should it take an access token to expire?

  3. When it is expired, what method should I follow? There is no refresh token in OAuth 2 implicit grant type. Should I ask users to enter their credentials again (this is not user-friendly) or store their credentials in a storage and sent it to an authorization server silently to get a new access token?

Improve this question
1
  • How did you go about token expiry and new token request flows.
    – maverick
    Jan 31, 2019 at 6:06

1 Answer 1

Reset to default
1

In your case, I think that OAuth 2 doesn't make sense. It's designed to handle third-party clients, and the additional complexity is likely to be a distraction when you only have one single first-party client.

For user security:

  • No matter what you do, a web-based app is one where the user has to trust some webpage of yours with their username/password. For this reason, it seems sensible to just directly username+password authentication and skip OAuth 2, unless you have some other reason to use OAuth 2.
  • For publicly-visible resources, allowing access without authentication should be fine.

For securing your API to be used only by your SPA:

  • This is a completely different issue than user sign-in, and I'd recommend not getting sidetracked by how to acquire access tokens. For instance, many SPAs can be trivially modified/decompiled/spoofed.
Improve this answer
2
  • Thanks for your response. So using JWT + Spring Security instead OAuth 2 for user security is fine I guess. Then the question is, how should i secure my API to be used only by my SPA? Do you have any recommendations?
    – Selçuk Işık
    Oct 14, 2018 at 15:03
  • Two points on securing the API to be used only by your SPA: (1) you can't really, at least not easily, (2) there are some techniques you can use to mitigate the issue, but the scope of that is large enough that it would be better asked as a new question (via the "Ask Question" button).
    – Soron
    Oct 14, 2018 at 15:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .