1

I'm writing a small web-app using Spring Boot 2 as the backend and Angular6/Ionic as the front end. The intention is to have users add the site to their home screen and for it to basically look/feel like a native app. This is working pretty well but I would like to use Google for login with Spring Security Oauth2. My problem is that Spring Boot keeps the user auth tokens on the server associated with the session, and the IOS home screen icon loads with all cookies cleared every time the icon is clicked. Since the cookie is gone when the page loads, the user needs to log in again.

Apparently html5 local storage should persist from launch to launch, so I'm thinking I need generate a key for the user after auth which can be stored in in local storage on the device, then when the the user accesses the page it can provide this key which I can use to "Authenticate" them on the server... something along those lines.

I'm looking for ideas of how to allow the user to stay "Logged in" without the availability of cookies being reliably stored for any length of time.

Currently Using Spring Boot 2 Angular 6 Ionic 4 Spring Security Spring Oauth2

Everything is behind security except for the login page.

At the moment I'm persisting sessions to jdbc and my configs look like this:

applicaion.yml

spring.security.oauth2.client.registration.google.client-id=XXXXX
spring.security.oauth2.client.registration.google.client-secret=XXXX

server.servlet.session.persistent=true
spring.session.store-type=jdbc
spring.session.jdbc.initialize-schema=always

MvcConfig.java

@EnableWebMvc
public class MvcConfig implements WebMvcConfigurer {

    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry.addResourceHandler("/static/**")
                .addResourceLocations("/static");

        registry.addResourceHandler("/static/*.js", "/static/*.css", "/static/*.svg")
                .addResourceLocations("/static")
                .setCacheControl(CacheControl.maxAge(365, TimeUnit.DAYS));
    }

}

SecurityConfig.java

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .anyRequest().authenticated()
                .and()
                .oauth2Login().and().logout().logoutSuccessUrl("/");
    }
}

I've tried telling spring to put session ID's as x-auth headers, but google oauth appears to stop working then. As in I go to a page, get the screen to click on to log in with google, log in with google and am returned to my login page with an error: "Your login attempt was not successful, try again."

So basically google oauth works with config above but fails with this added to SecurityConfig.java

@Bean 
public HttpSessionIdResolver httpSessionIdResolver() {
    return new HeaderHttpSessionIdResolver("X-Auth-Token");
}

This is apparently failing because The appropriate session information isn't getting passed to/back from Google. My login process produces 3 "sessions"
1) When the user first tries to access the page and gets the login page 2) When the token response is returned from google. This session indicates an error of "authorization_request_not_found" 3) When the user is re-directed back to the login page.

It looks like some info about the session is being passed to/back from google but the session ID's doing look right

Request to google auth is:

 https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=1111111111111-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com&scope=openid%20profile%20email&state=NGW6kTxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx%3D&redirect_uri=http://localhost.com:9733/login/oauth2/code/google

Callback from google auth:

 http://localhost:9733/login/oauth2/code/google?state=NGW6kTxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx%3D&code=4/xxxx_xxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&scope=openid+email+profile+https://www.googleapis.com/auth/userinfo.profile+https://www.googleapis.com/auth/plus.me+https://www.googleapis.com/auth/userinfo.email&authuser=0&session_state=6ee92xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx..2618&prompt=none
15
  • I will try to post a solution tomorrow, but only trick you can do is connected with window.location.search. Basically attempting to pass a token as param in url which might not be ideal. I have the same problem to solve;/ Oct 27, 2018 at 6:33
  • Yeah, the app isn't "High Security" or anything.. having trouble getting spring boot to accept a token anywhere but a cookie. Was trying to get x-auth header tokens to work.... I reallyJust want exactly the same thing as the session cookie.. but using headers... so I can pull the token from local storage and dump into a header. but I'll take anything at this point
    – jrlambs
    Oct 27, 2018 at 14:40
  • I will be tackling this on Monday, so if you won;t figure it out - lets collaborate;) I will try to post potential solutions I found by then. Please note btw that you can not have localStorage persistence across PWAs as each when "installed" is getting their own webview sandbox and hence their local persistences are separate Oct 27, 2018 at 16:46
  • Ok I’ll post some things that I’ve tried. Some might have worked if I understood spring security better. I don’t care about persistence across apps i just don’t want the user to have to re login every time they click the home screen icon for the same app. I wonder how google does this? When i click login with google it already knows who I am.. i just tap my account and I’m logged in with google. Somehow their stuff persists across apps.
    – jrlambs
    Oct 27, 2018 at 16:56
  • Well google could have access to way lower level apis easily. Even on IOS their apps may have more privileges vs us 3rd party devs. I want the same outcome - prevent user to login twice Oct 27, 2018 at 17:33

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.