2

I own a Play Framework application acting acting as a backend server providing a set of REST APIs.
At client side, I own an AngularJS application that calls APIs from backend-server through AJAX.

Currently, I make use of a solution based on Session-token mechanism.
Meaning that each time a user logs in successfully, a cookie is retrieved at client side containing an authentication token.
At each request then, the cookie value (the auth token) providing by the client request is extracted on the server and if valid, the request is made.

Now I want to use OAuth 2.0. Reasons are? :

  • It's a great standard way to secure API, avoiding the use of a datastore (Memcached) to keep auth tokens at server side, as I'm currently providing.
  • I want to provide a better secure than a sole cookie, by providing some client_secret and nonces to avoid some replay attacks etc...
  • I want to restrict the amount of clients capable to call even public REST API I provide, meaning API that allows anonymous call, like listing a list of items for instance.

The point is that I don't involve a third party, since all protected resources are on my own.
I came across this article explaining how to secure internal REST API with OAuth 2.0 implementing a 2-legged instead of a 3-legged as usual.

However, I can't figure out how the Client Credentials flow could authenticate a specific user, when calling for a REST API that needs to have a user authenticated.

Indeed, Client Credentials flow seems to be based on a global client_id, client_secret keys (global to the app, so in my case to my Javascript app), and therefore not enough specific to target a specific user and controller its specific rights.

Any help would be great.

1 Answer 1

3

Seems like you should use "Resource Owner Password Credentials Grant" (https://www.rfc-editor.org/rfc/rfc6749#section-4.3). It is dead simple - put client ID/secret in Authorization header and put user name/password in query variables. Here is an example from the RFC:

POST /token HTTP/1.1
Host: server.example.com
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded

grant_type=password&username=johndoe&password=A3ddj3w

Server side you can check for both validity of the client (your javascript app) as well as the user. Just remember that it is impossible to protect the client credentials as it will be embedded in your (downloadable) JavaScript code. The user name/password is entered directly by the end user.

5
  • I thought about this mode, but for API that demand an authenticated user. So what about a call of one of my API that allows anonymous calls. Indeed, it wouldn't need some end-user credentials, thus should I use "client credentials flow" for those specific cases? However, it wouldn't even make sense since Javascript is not a confidential client => anyone could grab the client_secret through a javascript debugger and use it on the app behalf. How to deal with this requirement? I strictly don't want any external user to call my public API (curl for instance), even unrestricted ones.
    – Mik378
    Feb 17, 2014 at 10:28
  • You cannot avoid clients calling your public API. Sorry. Feb 17, 2014 at 10:40
  • > thus should I use "client credentials flow" for those specific cases? You only use one of the four flows once when logging in - the result is a token of some kind to be used afterwards in the following requests. This is no different than the classic web site use of a login page and then storing the session id in a cookie. Feb 17, 2014 at 10:42
  • I understand. So no need to bother with OAuth specific elements (like client_id and client_secret) for any call public API since Javascript is not a confidential client. On the contrary, all calls that need an authenticated user would involve the "Resource Owner Password Credentials Grant" flow. Am I right? Thanks a lot for your help :)
    – Mik378
    Feb 17, 2014 at 10:45
  • > On the contrary, all calls that need an authenticated user would involve the "Resource Owner Password Credentials Grant" flow. Yes, but since the client may not know what calls to perform before logging in, it will have to use that flow always as the first request. Feb 17, 2014 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.