I am building an authentication system to be used within a company's private network. I do not administer this network, and I know very little about the setup, but my basic understanding is you must be on a local machine or VPN in to access it.
The system/services consists of:
- An OAuth server that uses JWT's as access_tokens
- A set of private APIs
- A public application that will utilize our internal services (OAuth server and API's)
For users of the public application I intend on storing their access and refresh token within a server side session, and all communication to our API's will be done from the backend.
For users of our private network (employees) I've opted to store their short lived access_token (10 minutes) AND refresh token (1-4 weeks) inside of cookies. The cookies are set as HttpOnly, secure, and SameSite=lax. I'm still struggling with the most secure way to use these cookies to authenticate users across all applications and APIs. Here are the two ideas I have at the moment:
Originally I just wanted all apps/services to simply accept the cookie as a valid authentication method. but I now understand this leaves me open to potential CSRF. So I would have to implement some type of stateless CSRF protection.
My second plan was to only allow the content serving applications to accept the cookie as an authentication method. Which would limit CSRF vulnerabilities to application content only. I would then pass the JWT to the application by embedding it into the actual HTML page, which could then be sent through Authorization headers to the APIs. I realize this is not secure storage of a JWT, and it could be compromised with CSRF. But my thinking was that being an internal network, the JWT's are essentially useless to anyone on the outside.