We have two web applications. One is developed in Django, let's call it portal (oAuth2 provider). Another is developed in PHP, let's call it client.

We want to display a link for authenticated users on the portal website, so that by clicking the link the user is automatically signed in to the client website. No password asked, the client website should open and the user should be already signed in on the client website.

Is it possible to implement such a magic link using oAuth2 or we have to create our own solution?

  • 2
    OAuth2 is not suited for authentication. OAuth2 is instead intended for authorization. If it is authentication you need, I suggest you look at OpenID Connect.
    – Jacco
    Nov 20 '18 at 12:28
  • It is worth noting that OpenID Connect is an extension of OAuth. When discussing magic links I assumed you meant a magic link, sent to an email for authentication. In which cases there are services like did.app which offer magic link authentication via an OpenID integration, which makes it very easy to use in multiple services Jun 11 '20 at 13:29

Yes you could use OAuth2 for this szenario, however I think that OAuth2 is a little too much overhead for this particular use case.

What you basically want is a JWT (Json Web Token). After authenticating against the portal, it creates a JWT-token. This token contains some information about the user, maybe his username / mail and his permissions. Also, this token gets signed with the private part of an asymmetric keypair - only the portal knows this private key. When accessing the client-application, you pass the token as an http-header (probably the authorization-header) with the request. Your client-app knows the public part of the asymmetric keypair so it can verify the token. When the token is verified and not expired, the user is authenticated in your client-app. Here you could also check some permissions which are included in the token.

You can read about JWT here: https://jwt.io

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.