5

We have a regular web application with cookie based auth and now we want to split frontend and backend (api) in order to have third-party public API. So our backend will be on one domain and frontend on another one.

For authorization we would like to switch for OAuth 2 with JWT. In this case our frontend app will have to use access_token instead of cookie session and it brings a big old question:

How To Remain Logged In - The Infamous "Remember Me" Checkbox (part II from Form based authentication for websites)

From OAuth2 point of view our frontend application going to use something between Resource Owner Password Credentials Grant and Implicit Grant. It is closer to Password Credentials Grant since we still going to use usual login form and won't redirect user to another domain in order to sign in. At the same time it is closer to Implicit Grant since it's all going to be browser-only & JavaScript based when access_token will be saved in browser.

The RFC says the authorization server MUST NOT issue a refresh token if you use Implicit Grant and my question is if it's still valid in this use case when you don't really use a 3-d party OAuth but your own api? Instinctively I feel that having refresh_token in browser is a security hole and would like to confirm it with you guys, but that refresh_token seems to be the only way to have persistent login working the same way as we had with cookies.


**UPD** after @FlorentMorselli comment:

The OpenID specs still do not answer my question if I can use refresh_token with browser only application

  • Google says they provide refresh_token only for access_type=offline
  • OpenID Connect Core says you cannot use Refresh Token with Implicit Flow
  • OpenID Connect Core says nothing about using refresh_token with Hybrid Flow
  • There's only one place where it says something promising about refresh_token with Hybrid Flow, but nothing precise

UPD2 thanks to @reallifelolcat

It looks like OpenID Connect does not explicitly support Resource Owner Password Credentials Grant, meaning you have to redirect user to OpenID Connect server to perform login. Do you know if there is another way to authenticate with user credentials over OAuth 2.0?


I believe splitting api and frontend is getting more common these days and I'd appreciate it if you share how you solve this Persistent Login issue and if you drop it completely and force user to re-login every X weeks.

Thanks!

6
  • 1
    OAuth2 is not an authentication protocol, it is an authorization one. If you want to authenticate users using OAuth2 and JWT, I recommend you to look at the OpenID Connect specifications Oct 15, 2014 at 5:35
  • @FlorentMorselli thank you for the link, I extended my question
    – rinat.io
    Oct 15, 2014 at 19:38
  • User-agent-based application are public clients and they are incapable of storing their credentials and refresh tokens. That is why these client can not issue refresh tokens. Native application (e.g. Android app) provides an "acceptable level of protection". That is why they may be allowed to get an access token (see tools.ietf.org/html/rfc6749#section-2.1). Oct 15, 2014 at 19:54
  • @FlorentMorselli It does allow you to retrieve, use and store access_token with Implicit Flow. It does not restrict you to use ONLY Implict Flow in browser. And it still does not explicitly say you MUST NOT use refresh_token in browser with different type of flow like Hybrid Flow for example
    – rinat.io
    Oct 15, 2014 at 20:18
  • As far as I know, the insuance of a refresh token with the Implicit Flow is not supported (look at this table). You are right, you are not restricted to use only Implicit Flow in browser, you could use the resource owner password credentials if available. With Hybrid Flow, you can get a refresh token. But this refresh token is never send to the browser, it is send to the redirect uri of your client by the token endpoint. Oct 16, 2014 at 8:28

1 Answer 1

5

Access tokens and refresh tokens have nothing to do with login with OpenID Connect. These are only for authorizing access to user profile information and for perhaps authenticated service calls to your public API after the fact of login. Refer to the spec for the difference between the ID Token and the Access Token.

If you are going to use OpenID Connect for login, then from what you've wrote so far, it sounds like you need to host your own OpenID Provider (OP) since you want to avoid going to another domain to sign in:

we still going to use usual login form and won't redirect user to another domain in order to sign in.

If you want to be your own Identity Provider, then more power to you. This means that you going to have to deploy your own working instance of an OpenID Connect server, complete with authorization and token endpoints.

Now this is the part where your persistent login comes in. Your browser webapp will be a relying party to the OP server you now have. When a user tries to login to your browser app using OpenID Connect, they will need to authenticate themselves to your OP server. Going through the OIDC flow, your browser app will get an ID token containing an issuer/subject pair identifying the user.

It's up to you to determine how the user stays logged into your OP server, but as long as the user at least authorizes the browser app once: http://openid.net/specs/openid-connect-core-1_0.html#Consent then you can save that consent for all future requests by this browser app to login, and therefore maintain a persistent login.

You're going to have to consider how you're going to handle sessions management, but it sounds like you have some cookie thing going already so you might be able to use that (see this answer: OpenID sign in mechanism - Stay signed in ). Otherwise, you're going to end up with a situation where your browser webapp has to get a new id token all the time.

Also as Florent mentioned, there are security considerations you should consider when doing a public client thing that your browser based webapp would be. Example: https://www.rfc-editor.org/rfc/rfc6749#section-10.16

5
  • thanks a lot for your answer, following your links I was able to find Immediate Requests specs which sounds promising, but it is not in OpenID Connect for some reason. Do you know if it is removed? Also now I found that OpenID Connect does not support Resource Owner Password Credentials Grant.
    – rinat.io
    Oct 17, 2014 at 0:36
  • It seems to be too complicated for such simple use case. OAuth doesn't let you perform authentication, OpenID forces you to redirect user to OpenID provider. Hard to figure out what spec to follow
    – rinat.io
    Oct 17, 2014 at 0:46
  • That first link is from OpenID 2.0 (now obsolete). It's not that it's removed; OpenID Connect is simply != OpenID 2.0. OIDC is not even a "OpenID 3.0", and if you don't know what that means, sounds like you have some googling to do. As for why those other flows aren't in the OIDC spec, keep in mind that OIDC is an authentication protocol and look at this diagram OAuth Client Credentials Grant. Ask yourself: What does it mean to do authentication when the user is not even in the picture? (hint: You're doing it wrong). Oct 17, 2014 at 14:40
  • Doing authorization and authentication to a third party is a hard problem, and in my opinion OAuth2.0 and OpenID Connect provide a simple and straightforward technical solution to that hard problem for many use cases. However, since your question here was specifically about doing persistent login with OAuth/OpenID and not about what is the best protocol for your use case, I am going to leave it at that :) Good luck! Oct 17, 2014 at 14:44
  • I've been googling 3 days and I'm looking for a standard solution (protocol) for our simple (I guess) use case. I didn't ask why OpenID 2.0 was removed, I did ask why Immediate Requests section is not presented in OpenID Connect specs that I intended to use. In your first comment you're talking about Client Credentials Grant while I was referring to Resource Owner Password Credentials Grant. I am not for holy war here. Thank you for your help and effort
    – rinat.io
    Oct 17, 2014 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.