SPA Authentication Flow for Browser Applications

README.md

SPA Authentication Flow for Browser Applications

This gist is a collection of resources on the topic of SPA Authentication Flow for Browser Applications.

OAuth 2.0 for Browser-Based Apps

• IETF
  • draft-parecki-oauth-browser-based-apps-02
  • draft-ietf-oauth-browser-based-apps-03

Token storage on client side

• Stormpath
  • Token Based Authentication for Single Page Apps (SPAs)
  • Where to Store your JWTs
• OWASP
  • Token storage on client side
  • Local Storage
  • Security Risks (HTML5 Web Storage APIs)
• Auth0
  • Where to Store Tokens
• Two Cookie JWT Approach

Conclusion

The simplest solution for SPA Authentication Flow for Browser Applications is to have a normal session based authentication flow and an API Gateway. Whenever the client tries to access data from the API, they need to call the gateway which authenticates the client and the gateway calls the API. After the gateway receives the data it simpli returns the unmodified data to the client.

+---------+
|   API   |
+---------+
   ^   |
   |   | Some kind of token to identify Gateway application eg. Oauth 2.0 token.
   |   v
+---------+
| Gateway |
+---------+
   ^   |
   |   | Browser cookie based authentication flow.
   |   v
+---------+
|   SPA   |
+---------+