0

This is the architecture I want to follow

enter image description here

Source: https://stackoverflow.com/questions/73075156/what-exactly-is-redirect-uri-in-google-oauth2-request-for-getting-authorization

I'm using a backend to exchange tokens with the authorization code, then send the tokens back to the frontend via set-cookie header.

Would PKCE be required for this case? I think it's unnecessary here since the client secrets can be safe in the Django server, just wanted a confirmation as I'm new to this realm.

Also, I'll be encrypting the state parameter in the front-end, and decrypting it in the backend probably using asymmetric keys.

Is there any security vulnerability in these approaches?

EDIT:

If PKCE is required, how could we share the code verifier between the client and the server?

Improve this question
6
  • You don't need PKCE for the service.
    – defalt
    Nov 25, 2022 at 14:55
  • "Also, I'll be encrypting the state parameter in the front-end, and decrypting it in the backend probably using asymmetric keys." Don't really understand this part. What are the motivations for doing that?
    – ysdx
    Nov 26, 2022 at 8:13
  • Does this answer your question? Why not use PKCE for backend apps, too?
    – ysdx
    Nov 26, 2022 at 8:15
  • @ysdx If there is a code injection attack, the bad actors state parameter probably wouldn't be encrypted, so when I wont be able to decrypt it in the backend, and hence would come to know its sent by a bad actor
    – MrRobot9
    Nov 26, 2022 at 23:54
  • @MrRobot9, While encryption might be useful for ensuring the confidentiality of the state, you should use either a signature ot a MAC to protect its integrity (datatracker.ietf.org/doc/html/…).
    – ysdx
    Nov 27, 2022 at 15:40

1 Answer 1

Reset to default
2

PKCE is not absolutely necessary because you are using a confidential client. The PKCE spec was designed as a protection for public clients (see the title "Proof Key for Code Exchange by OAuth Public Clients".

However, PKCE usage has been found useful for confidential clients as well. The current security best practices draft recommends using it even for confidential clients because it can be a useful countermeasure against Authorization Code Injection.

Moreover, the current Oauth 2.1 specification requires using the PKCE for the authorization code grant:

the authorization code grant according to this specification requires the addition of the PKCE parameter

Concerning the way to exchange the token with the client for browser based apps, you will find some pattern suggestion in the relevant draft. In the Token Mediating pattern you will find this recommendation:

The frontend SHOULD NOT persist tokens in local storage or similar mechanisms; instead, the frontend SHOULD store tokens only in memory

Cookies are a persistent storage (which might end up being stored on disk even for session cookies) so you should probably not store the access token in cookies.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .