I have a single page application which communicates with a REST backend. I want to require a user to login before being allowed to access certain routes. I want to offload user authentication to another service with a "Login with X" button. I have several questions related to this.
I understand that OAuth2, on its own, is not an authentication protocol. However, it is my understanding that the Authorization Code grant type, when combined with a non-standard "
/me" endpoint from the resource provider can be used to facilitate authentication. Is that correct?
If that is correct, then does this describe a secure process for doing so?
My frontend is
my-frontend.com and the backend is
my-backend.com which has the routes
- A user directs their browser to
my-frontend.comand clicks "Login with X"
- A request is made to
my-backend.com/authorizewhich generates a URL to the Authorization Server for X with the appropriate request parameters:
client_idis the client id of my app registered with X
stateis a random string (which is temporarily stored)
- The backend redirects the client to the generated URL and the user authorizes my application on X
- The client is redirected to
my-backend.com/authorize/callback(because that was
- The backend receives that request with the new request parameters. It checks that the
statematches one of the random strings it has generated and then makes a request to the Authorization Server to exchange the
codefor an access token. That token is stored in the backend, associated with the current session.
Now, any time that the client makes a request to
/must-be-authed, my backend makes a request to the Authorization Server's "
/me" endpoint with the access token associated to the session to check if the client is authenticated.
Please correct any misunderstandings I have with the process and make suggestions for improvement.
Edit: The final point, which I have now bolded, is the main thing that I am unclear on at the moment. I am unable to find any source or example of someone doing that.