Automatic reauthenticate at oauth2 endpoint

Question

I am currently (ab)using an oauth2 endpoint of an API to enable users of the API to log in to my site (using response_type=code). I do not save refresh tokens or even access_token as that oauth2 endpoint doesn't support scopes and I want to minimize the dangers of stolen accounts.

The oauth2 endpoint does a successful redirect to my auth page (PHP) if the user already granted my client_id permissions and is already logged in via that service. This will happen without user interaction. My auth page will set some session variables and redirect to the appropriate page.

The session to my server could expire when the user just created a lot of data and want to save it (via AJAX). So, I want to automatically re-authenticate the user via the oauth2 provider (in case the session if it is still alive) without sending him on a series of redirects.

Thus the idea is:

• If a once logged in user needs to be re-authenticated I create an image with an onload/onerror listener pointing to my auth endpoint.
• My auth endpoint will then redirect to the oauth2 endpoint, which in turn redirects back to my auth site if the user already granted the permissions.
• My auth endpoint updates the session and returns a single-pixel image if the authentication was successful. Otherwise not.
• If the image.onload event fires on the client side and the image width * height == 1 the user is re-authenticated.
• If the onerror event fires or width*height is!= 0 user interaction is required.

Are there any potential problems I may have missed and/or does this pattern exists?

As far as I see this way we would generate one more request to the oauth2 endpoint if the user session at the oauth2 provider is expired / the permission where revoked. On the other hand, if the user is still authenticated, we don't need any additional requests + the user doesn't need to load all the CSS+JS of the oauth2 endpoint.

Answer 1

Overall, your approach is very interesting, but there are several points you should definitely pay attention to.

As an option, you can use an iframe for "silent" authentication. Something like: <iframe src="/auth/silent" style="display:none;"></iframe> The /auth/silent endpoint initiates the authentication process and refreshes the user’s session.

For session checking, we can use AJAX requests to maintain control over the process. Plus, ideally, store the refresh_token securely to obtain new access_token without requiring the user to re-authenticate.