6

I am currently (ab)using an oauth2 endpoint of an API to enable users of the API to login to my site (using response_type=code). I do not save refresh tokens or even access_token as that oauth2 endpoint doesn't support scopes and I want to minimize the dangers of stolen accounts.

The oauth2 endpoint does a successful redirect to my auth page (PHP) if the user already granted my client_id permissions and is already logged in via that service. This will happen without user interaction. My auth page will set some session variables and redirect to the appropriate page.

As the session to my server could expire when the user just created a lot of data and want to save it (via AJAX). I want to automatically re-authenticate the user via the oauth2 provider (in case the session there is still alive) without sending him on a series of redirects.

Thus the idea is:

  • If an once logged in user needs to be re-authenticated i create an image with an onload/onerror listener pointing to my auth endpoint.
  • My auth endpoint will then redirect to the oauth2 endpoint, which in turn redirects back to my auth site if the user already granted the permissions.
  • My auth endpoint updates the session and returns a single pixel image if the authentication was successful. Otherwise not.
  • If the image.onload event fires on the client side and the image width * height == 1 the user is re authenticated.
  • If the onerror event fires or width*height are != 0 user interaction is required.

Are there any potential problems i may have missed and/or does this pattern exists?

As far as I see this way we would generate one more request to the oauth2 endpoint if the user session at the oauth2 provider is expired / the permission where revoked. On the other hand, if the user is still authenticated, we don't need any additional requests + the user doesn't need to load all the CSS+JS of the oauth2 endpoint.

migrated from stackoverflow.com Dec 18 '17 at 23:32

This question came from our site for professional and enthusiast programmers.

  • Have you considered using OpenID Connect. At least it provide you with prompt=none which essentially is prompt free re-authentication – KcDoD Nov 18 '17 at 16:44
  • @KcDoD that is basically what i have currently if the user already granted my App the permission. Thus the idea of using an Image to re authenticate in the background. – SleepProgger Nov 19 '17 at 15:10
  • Could you provide some additional details on your technology stack? Specifically, what's on the front end, what's on the back end, and which of these steps is happening where? Who all is maintaining a session, and which one(s) are expiring? Where are you detecting that a "once logged in user needs to be re-authenticated", and how? It isn't clear to me why an image would need to be involved. Why doesn't a regular series of redirects fulfill your use case? – Mike Patrick Nov 20 '17 at 2:15
  • @MikePatrick Updated the Question, but its late for me, sry if something remains unclear. I will update the question properly tomorrow. | In short: javascript interacting via ajax with Php rest API ; The oauth2 endpoint is used to authenticate at my rest API; The session to my rest api is expiring which i see when the user tries to save data – SleepProgger Nov 20 '17 at 5:13
  • Could you provide some additional details on your technology stack?Where are you detecting that a "once logged in user needs to be re-authenticated – Lisa Coffey Apr 19 '18 at 7:06

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.