Say I had a centralized OAuth 2 authentication server, a Single Page Application (SPA) in an electron app, and a third-party server. The user launches this SPA, goes through the PKCE flow to obtain an access & refresh token, and is now authenticated. The SPA is now allowed to access & modify information in the authentication server.

Next, say this SPA wanted to access a third party API, which performs some function - in my case, it provides authenticated downloads to a client. That third party API can already authenticate a user via the normal OAuth flow, having a user access the page, redirect the user to the authentication server, and then send the user back with an access code, which the third party API exchanges for an access token. But instead, what happens if I want this SPA to access the third party service? The SPA isn't "signed in" to the authentication server, since it is only an OAuth client, and the user can't just go to the authentication server's URL to follow the standard authorization code flow. What would be the process to generate an access token for this third party API to allow access to the authentication server on the user's behalf - retrieving or modifying information about the user?

Thanks in advance!

  • Why can't the SPA use the oauth flow for the third party service ? isn't the 3rd party API a resource server in this case, to which the SPA can present an access token and the 3rd party api will verify it with the oauth server and allow access to the resource ?
    – gaurav5430
    Commented Nov 17, 2022 at 11:07

2 Answers 2


Adding more accurate answer based on the discussion above.

Based on your clarification in the comments the flow is to try to download a resource through the SPA, after sign in. Then the appropriate course of action is to change the third party service to verify the access token that SPA will send to it, on behalf of the user. This way SPA will not know and neither should it care how access tokens are generated. This will make sure no one can exploit the mechanism to generate access tokens freely.

Given that secure channels(TLS) should always be used for all interactions between OAuth service and any other subsequent interactions with thirdparty service to make sure no one can eavesdrop and obtain tokens. Make sure the access token has a shorter TTL to minimize the possibility of replay attacks. Have a look at the OAuth Threat Model since you are writing your own OAuth server.

[Diagram explaining the flow2

Of course this means you have to be able to configure your user permissions per resource.

  • why do we need a requestBearerToken ?
    – gaurav5430
    Commented Nov 17, 2022 at 11:06

First and foremost the OAuth protocol is used for delegated authorization. To support authentication you need to do a bit more on top of OAuth2.

Having said that, the problem you have described is a SSO(Single Sign On) problem. There are different protocols to achieve this. The most popular one right now is OpenIdConnect. Have a look at the docs of the thirdparty service you are accessing to see if they support SSO using OpenidConnect.

Almost all the major service providers support this nowadays. This is exactly what you go through when you click on Sign In with Google button on a site. As you can see from their example of server side app flow, this is leveraging OAuth2 itself.

So if I understand your dilemma, what you need to do is that;

  1. Go through the OAuth flow of you internal OAuth server to authorize your SPA to your service, which is the base service provider in this case.
  2. In case of a fresh login offer the user to integrate with the third party service using a button just like Google Sign In. This may already supported by the service provider.
  3. When user logs in and give permissions for the integration save the information returned by the thirdparty service associated with credentials of your user. When you do this you won't have to show the integration option in step 2 again to the user until he revokes the permission or signs out from your SPA.
    1. Provide an option for user to revoke the permissions he provided for the third party services. This may or may not trigger a sign out from your SPA. Decision is based upon how tightly coupled these services are.
    2. If the user signs out you can keep the info you retrieved for the next session.

enter image description here

  • Sorry, I probably should have clarified this a bit more. I'm programming every part of this - the authentication server (it is an SSO), the "third-party" service, and the SPA. I agree that I would use "sign in with (sso)". The issue is more along the lines of I need to use the SPA to create an access token to be used by the "third-party" service. Commented May 5, 2020 at 19:13
  • I see. So your are trying to download a resource through the SPA, after sign in. If I got this correct this time then what you should do is to change the third party service to verify the access token that SPA will send to it, on behalf of the user. Which means you should be able to configure user authorizations per resources. Perhaps a diagram of the flow might help. Let me know if I have understood wrong.
    – Sithum
    Commented May 6, 2020 at 12:28
  • I believe you are understanding it perfectly. Would it be safe to send the access token from the oauth service that the SPA obtains over to the third-party service? Using an audience restriction on the bearer token, so a fourth party can't impersonate them? Commented May 6, 2020 at 22:15
  • Correct, It is safer because then the SPA is not aware of the mechanism for access token generation and neither it should care. Don't get it wrong this has it's own vulnerabilities. For an instance an obvious one is a replay attack by getting hold of a valid token through eavesdropping the channel between SPA and thirdparty service. This can be mitigated by using secure channels(TLS), and having shorter TTLs for the access token. Because you are writing your own OAuth service have a look at the threat model tools.ietf.org/html/rfc6819#section-1 I'll update the answer for clarity
    – Sithum
    Commented May 7, 2020 at 0:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .