In a new project, we try to clarify how authorization should look like. I've been reading up on this for days, but it's not really clear to me which solution would be the right one to use. Some solutions are not recommended anymore, some solutions will not work in the future.
- The backend is PHP/MySQL.
- There are multiple frontend client types planned:
- SPA website using ReactJS
- Browser extension using ReactJS (SPA)
- Desktop app using Electron and ReactJS. (Also a SPA)
- Mobile app using React Native
- Communication with REST APIs
- The system handles tasks, inventories, wikis, documents only. So no critical finance or health information.
- Users register/login with username and password.
- In a typical use-case the users do an action every 1-2 hours. (So a typical 30min server-side user session expires between usages)
- The user can use multiple clients parallel. So make some actions on the website, then later some on his/her mobile.
- The goal is to avoid username/password logins every time a user does an action. Login once every 2-4weeks is acceptable.
- We don’t have a dedicated authorization server. The resource server and authorization server would be the same PHP backend on the same domain/server.
Here is my research summary:
- According to this document: https://auth0.com/docs/authorization/flows/which-oauth-2-0-flow-should-i-use we should use “Authorization Code Flow with Proof Key for Code Exchange (PKCE)” in all of our cases.
- However according to this article: https://auth0.com/blog/refresh-tokens-what-are-they-and-when-to-use-them/ it seems that using auth token and refresh token rotation is even better.
- In this article https://auth0.com/docs/login/configure-silent-authentication says that “browser-based flows must use Refresh Token Rotation, which provides a secure method for using refresh tokens in SPAs while providing end-users with seamless access to resources without the disruption in UX caused by browser privacy technology like ITP.”
- This article https://auth0.com/blog/securing-single-page-applications-with-refresh-token-rotation/ also notes that Authorization Code Flow with PKCE will not work in the future.
Am I right in thinking that - now in 2021 - a refresh token rotation solution would be best? It seems to be even a bit easier to implement. Or am I missing something or confusing something?