OAuth 2 Password Grant with First Party Mobile and Single Page Apps

user_1569339 0
Viewed 2621

I am working a project that has both a first party mobile app and single page web app. I want to use OAuth 2 for authentication, but am wondering whether or not it is advisable to allow for these public first party clients to use this grant type considering that they cannot protect their client credentials.

Ideally I do not want to push mobile users to an external browser or web app users to a separate web page for authentication with an authorization code grant type.

Can I make the password grant type work with these client types or should I explore an alternative to OAuth for first party applications?

single-page-application oauth-2.0 mobile oauth authentication
1 Answers

For "trusted" applications, i.e. as you say "first party" applications, it's usually okay to go with the Resource Owner Password Grant for Mobile applications. You exchange the username and password for an access token and a refresh token which you then store as safely as possible in your mobile application. Don't forget to purge the username and password of the end user from memory after that is done.

For Single Page Applications the go to grant flow is rather the Implicit Grant, where you will receive an access token via redirect in the fragment (#access_token=...), so that the SPA can pick it up from there. In this case, the SPA will never ever have the username and password in its own scope. Those will only be exposed to the Authorization Server and/or the Identity Provider's login interface (depending on your implementation).

In case of the SPA you'd still have an initial redirect to the Authorization Server for initial authentication and authorization; in case you need to refresh access tokens, you could look into the OIDC spec where an additional &prompt=none addition is introduced to enable getting new access token via the implicit grant in e.g. a hidden iframe. In the end, this method relies on the Authorization Server having a session with the end user's User Agent (=browser), but not with the SPA's origin, which can be a static web server of any kind.

user_16928300
Related