Hello I have a standalone accountless javascript application and I need to do some api calls with my .net core 3.1 api. What is the best way to secure application and my api? After some research I read that if I have an oauth 2.0 server the best grant type for javascript applications is authorization code flow with pkce. Is this implementation possible for accountless javascript applications? Thanks
1 Answers
Use dynamic Proof Key for Code Exchange (PKCE) created from Javascript client instead of client secret. Do not use client secret.
Create a random string between 43-128 characters long, then generate the url-safe base64-encoded SHA256 hash of the string. The original random string is known as the code_verifier, and the hashed version is known as the code_challenge.
Create a random string (code verifier), e.g. 5d2309e5bb73b864f989753887fe52f79ce5270395e25862da6940d5
Create the SHA256 hash, then base64-encode the string (code challenge): MChCW5vD-3h03HMGFZYskOSTir7II_MMTb8a9rJNhnI
In the initial Oauth2.0 request, pass code_challenge to get authorization code. Then when exchanging authorization code with token, pass the code_verifier. That ensures that even if authorization code gets intercepted, there is no way "Man in the middle" can exchange that for token. See below links on how to implement the same
https://aaronparecki.com/oauth-2-simplified/#single-page-apps https://developer.okta.com/blog/2019/05/01/is-the-oauth-implicit-flow-dead
Related