如何使用Oauth2和javascript客户端实现长期登录会话（Spring Oauth2 + Angularjs）

Question

I've a spring backend with Spring OAuth2 and Angular client.

What is the proper way to achieve long lived logins which is still arguably secure .

I guess I can use password flow and refresh tokens , but this doesn't seem any safer than using long lived access tokens with implicit flow for browser clients. I think I can use:

• Redirects - which will interfere with whatever user was doing
• Popups - which will get blocked without user interaction

on the client level. But is there any better approach?

PS: Cloudfoundry's new UI seems to have achieved exactly what I want.

Answer 1

The auth code flow is always superior (more secure and less chance of leaking user cerdentials). If you are writing a browser-hosted client contacting the OAuth2 service directly then unfortunately you won't be able to get hold of the access token from the auth code flow. For that reason I think I would prefer to use access tokens between machine (non-browser) clients, and standard cookie-based authentication between the browser and the front end server. You can still use OAuth2 on the front end server to do the authentication (I'm pretty sure that's what the CloudFoundry server is doing) if you expose a /me or /user_info type endpoint.

Or if you really need to get the access token in your client (I guess there are libraries for dealing with it), you can use password or implicit grant. Implicit is strongly preferred on security grounds (since the user only types his password into the auth server authentication UI), but in both cases you need to take care to segregate your client data so the (unauthenticated) clients don't get access to anything they shouldn't.

Answer 2

我的解决方案是使用带隐式授权的隐藏iframe。