I am currently (ab)using an oauth2 endpoint of an API to enable users of the API to log in to my site (using response_type=code). I do not save refresh tokens or even access_token as that oauth2 endpoint doesn't support scopes and I want to minimize the dangers of stolen accounts.

The oauth2 endpoint does a successful redirect to my auth page (PHP) if the user already granted my client_id permissions and is already logged in via that service. This will happen without user interaction. My auth page will set some session variables and redirect to the appropriate page.

The session to my server could expire when the user just created a lot of data and want to save it (via AJAX). So, I want to automatically re-authenticate the user via the oauth2 provider (in case the session if it is still alive) without sending him on a series of redirects.

Thus the idea is:

  • If a once logged in user needs to be re-authenticated I create an image with an onload/onerror listener pointing to my auth endpoint.
  • My auth endpoint will then redirect to the oauth2 endpoint, which in turn redirects back to my auth site if the user already granted the permissions.
  • My auth endpoint updates the session and returns a single-pixel image if the authentication was successful. Otherwise not.
  • If the image.onload event fires on the client side and the image width * height == 1 the user is re-authenticated.
  • If the onerror event fires or width*height is!= 0 user interaction is required.

Are there any potential problems I may have missed and/or does this pattern exists?

As far as I see this way we would generate one more request to the oauth2 endpoint if the user session at the oauth2 provider is expired / the permission where revoked. On the other hand, if the user is still authenticated, we don't need any additional requests + the user doesn't need to load all the CSS+JS of the oauth2 endpoint.

  • Have you considered using OpenID Connect. At least it provide you with prompt=none which essentially is prompt free re-authentication
    – KcDoD
    Nov 18, 2017 at 16:44
  • @KcDoD that is basically what i have currently if the user already granted my App the permission. Thus the idea of using an Image to re authenticate in the background. Nov 19, 2017 at 15:10
  • Could you provide some additional details on your technology stack? Specifically, what's on the front end, what's on the back end, and which of these steps is happening where? Who all is maintaining a session, and which one(s) are expiring? Where are you detecting that a "once logged in user needs to be re-authenticated", and how? It isn't clear to me why an image would need to be involved. Why doesn't a regular series of redirects fulfill your use case?
    – Mike Patrick
    Nov 20, 2017 at 2:15
  • 1
    @MikePatrick Updated the Question, but its late for me, sry if something remains unclear. I will update the question properly tomorrow. | In short: javascript interacting via ajax with Php rest API ; The oauth2 endpoint is used to authenticate at my rest API; The session to my rest api is expiring which i see when the user tries to save data Nov 20, 2017 at 5:13
  • Could you provide some additional details on your technology stack?Where are you detecting that a "once logged in user needs to be re-authenticated Apr 19, 2018 at 7:06


Browse other questions tagged or ask your own question.