Can an open id connect id token be used to authenticate to an api

Viewed 412

I am building a mern application.

the backend built using express exposes an api which users can create data and access the data they have created.

I want to allow users to sign in with google and get authorization to create and access the resources on this api which i control (not on google apis).

I keep coming across oauth 2 / open id connect articles stating that an Id token is for use by a client and a access token provided by a resource server should be used to get access to an api. e.g. https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/

the reason stated for this is that the aud property on the id token wont be correct if used on the api.

I realise that some sources say: that if the spa and api are served from same server and have same client id and therefore audience I can use and id token to authenticate to the api, but I am looking to understand what I can do when this is not the case?

I feel using oauth2 for authorization is overkill for my app and I cant find any information about how to use open id connect to authenticate to my api.

Surely when you sign in to Auth0 authourization server using google it is just requesting an open id connect id token from google?

I am wondering if using Authorization Code Grant flow to receive an id token on the api server would allow me to authenticate a user to my api?

in this case would the api server be the client as far as open id connect is concerned and therefore the aud value would be correct?

I can generate an url to visit the google oauth server using the node googleapis library like so:

const { google } = require("googleapis");

const oauth2Client = new google.auth.OAuth2(
    'clientid','clientsecret',
    "http://localhost:3000/oauthcallback",//this is where the react app is served from
);

const calendar = google.calendar({ version: "v3", auth: oauth2Client });


const scopes = ["openid"];

const url = oauth2Client.generateAuthUrl({
  // 'online' (default) or 'offline' (gets refresh_token)
  access_type: "offline",
  // If you only need one scope you can pass it as a string
  scope: scopes,
});

async function getUrl(req, res) {
  console.log(url)
  res.status(200).json({
    url,
  });
}

and use the following flow.

enter image description here

1 Answers

You are not supposed to access any API's using the ID-Token. First of all the life-time of the ID-token is very short, typically like 5 minutes.

You should always use the access-token to access API's and you can using the refresh token get new access-tokens. The ID-token you can only get one time and you use that to create the local user and local cookie session.

If you are using a SPA application, you should also consider using the BFF pattern, to avoid using any tokens in the SPA-Application see The BFF Pattern (Backend for Frontend): An Introduction

I agree with one of the commenters that you should follow the principle of separation of concern and keep the authorization server as a separate service. Otherwise it will be a pin to debug and troubleshoot when it does not work.

Related