We have an authorization server which exposes a login page, we would like to authenticate users in our single page app using this authorization server. My employer does not want to redirect users to the authorization server to login due to UX, and I do not want to resort to using the resource owner password flow.

Since we are developing the client ourselves is it acceptable to embed the authorization servers login page in our client via an iframe, prevent other websites from embedding it via the Content-Security-Policy header, and use the Authorization code flow + PKCE?

If it helps we are using IdenityServer4.

EDIT: From what I understand the main concern with allowing your authorization servers login page to be embedded in an Iframe is that it would be susceptible to click jacking attacks. But if I add headers which only allow it to be embedded only in trusted clients we would be protected against that, assuming the end user is using a compliant browser. https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-23#section-10.13

1 Answer 1


You simply develop the client, you don't own it. As soon as someone installs it on their devices, you don't own it anymore.

Anybody can then analyze the client code, find the authorization server, and access the URL from outside, by hand. Content Security Policy is an agreement between browsers, so if I run the request by hand using curl, for example, CSP will not save you.

Ask your employer why the redirect is not allowed and what he suggests. Embedding the authorization server in the client is asking for someone to decompile it, find the authorization process, and create a "keygen" in a couple hours.

  • I'm not sure that curl is the right example to support your point; better might be that someone could reverse-engineer it and call the underlying APIs directly from their browser client. Apr 2, 2020 at 23:49
  • Sure, calling from the browser would be faster, but curl can create thousands of requests and authenticate far more keys.
    – ThoriumBR
    Apr 3, 2020 at 0:00
  • I guess it depends what threat you're worried about. You're not going to phish anyone by asking them to type their username / password into curl. Apr 3, 2020 at 0:15
  • How does using the traditional oauth redirection scheme prevent someone from creating a keygen? You can still analyze the communication between the client and the authorization server if its not embeded in an iframe, by inspecting all the redirects. Apr 3, 2020 at 12:33
  • OP is embedding the server on the client... That's the difference. And using a server to authenticate means rate-limiting can be used. Not if the server is on the hands of the attacker and he have all the time he needs to inspect and attack it.
    – ThoriumBR
    Apr 3, 2020 at 17:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .