I am currently (ab)using an oauth2 endpoint of an API to enable users of the API to log in to my site (using
response_type=code). I do not save refresh tokens or even
access_token as that oauth2 endpoint doesn't support scopes and I want to minimize the dangers of stolen accounts.
The oauth2 endpoint does a successful redirect to my auth page (PHP) if the user already granted my
client_id permissions and is already logged in via that service. This will happen without user interaction.
My auth page will set some session variables and redirect to the appropriate page.
The session to my server could expire when the user just created a lot of data and want to save it (via AJAX). So, I want to automatically re-authenticate the user via the oauth2 provider (in case the session if it is still alive) without sending him on a series of redirects.
Thus the idea is:
- If a once logged in user needs to be re-authenticated I create an image with an
onerrorlistener pointing to my auth endpoint.
- My auth endpoint will then redirect to the oauth2 endpoint, which in turn redirects back to my auth site if the user already granted the permissions.
- My auth endpoint updates the session and returns a single-pixel image if the authentication was successful. Otherwise not.
- If the
image.onloadevent fires on the client side and the
image width * height == 1the user is re-authenticated.
- If the
onerrorevent fires or
width*height is!= 0user interaction is required.
Are there any potential problems I may have missed and/or does this pattern exists?
As far as I see this way we would generate one more request to the oauth2 endpoint if the user session at the oauth2 provider is expired / the permission where revoked. On the other hand, if the user is still authenticated, we don't need any additional requests + the user doesn't need to load all the CSS+JS of the oauth2 endpoint.