I have a single page application which communicates with a REST backend. I want to require a user to login before being allowed to access certain routes. I want to offload user authentication to another service with a "Login with X" button. I have several questions related to this.

I understand that OAuth2, on its own, is not an authentication protocol. However, it is my understanding that the Authorization Code grant type, when combined with a non-standard "/me" endpoint from the resource provider can be used to facilitate authentication. Is that correct?

If that is correct, then does this describe a secure process for doing so?

My frontend is my-frontend.com and the backend is my-backend.com which has the routes /authorize, /authorize/callback, and /must-be-authed.

  1. A user directs their browser to my-frontend.com and clicks "Login with X"
  2. A request is made to my-backend.com/authorize which generates a URL to the Authorization Server for X with the appropriate request parameters:
    • response_type is code
    • client_id is the client id of my app registered with X
    • redirect_uri is my-backend.com/authorize/callback
    • state is a random string (which is temporarily stored)
  3. The backend redirects the client to the generated URL and the user authorizes my application on X
  4. The client is redirected to my-backend.com/authorize/callback (because that was redirect_uri)
  5. The backend receives that request with the new request parameters. It checks that the state matches one of the random strings it has generated and then makes a request to the Authorization Server to exchange the code for an access token. That token is stored in the backend, associated with the current session.

Now, any time that the client makes a request to /must-be-authed, my backend makes a request to the Authorization Server's "/me" endpoint with the access token associated to the session to check if the client is authenticated.

Please correct any misunderstandings I have with the process and make suggestions for improvement.

Edit: The final point, which I have now bolded, is the main thing that I am unclear on at the moment. I am unable to find any source or example of someone doing that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.