23B/ TMI BFF: OAuth Token Mediating and session Information Backend For Frontend

From IIW

TMI-BFF - OAuth Token Mediating and Session Information Backend For Frontend

Thursday 23B

Convener: Vittorio Bertocci

Notes-taker(s): David Waite

[[File:./media/image1.png|115x111px]]

Tags for the session - technology discussed/ideas considered:

OAuth, Javascript, Backend Infrastructure

Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps: 

When there is an alternative, it is more secure to keep tokens out of the browser.

Specifically talking about clients which are divided between a front end or javascript app, and backend supporting systems specifically for that/those apps

Questions on whether this would also apply equivalently to native apps, which may have different capabilities and infrastructure requirements. It likely does work, but

OAuth in the browser can be complicated and ASs don’t necessarily provide sufficient security features, support web interaction

Bespoke workarounds acquiring tokens on the backend and passing to the frontend. Implementers may have security issues and not understand how to map best current practices

TMI BFF

  1. Backend gets and stores tokens, javascript frontend gets a cookie

  2. Request to backend for access (scopes, potentially resource)

  3. Backend returns the token, requests new token with appropriate scope, etc.

Discussions on:

Prescriptive for RP/client, which is somewhat unique in terms of standards and pushing for infrastructure/security/complexity in the hands of the OP.

Does this become a best practice - starts out with a documented process

What is the scope - acquiring a token for direct API access, not necessarily prescriptive for BFF architectures which put all API interactions through BFF. (DW) raised issue that simply converting OAuth calls in a remote party to local API calls protected by a cookie disables some security protections provided by OAuth tokens (XSRF), so some sort of BFF best practices may be needed to prevent footguns.

Discussions on how prescriptive the specification should be about what to do when there are no valid tokens on the backend - e.g. provide authentication endpoints vs having that be an implementation decision.

Retrieved from "https://iiw.idcommons.net/index.php?title=23B/_TMI_BFF:_OAuth_Token_Mediating_and_session_Information_Backend_For_Frontend&oldid=23755"