使用自定义标头重定向到外部站点-AngularJS / OAuth

Question

Is it makes sense to do a redirection to an external site (OAuth sever) with custom headers in order to authenticate the user?

For example, after providing your credentials to http//this_is_my_site/login you click login, and redirects you to the external address http://OAuth_Server/oauth/autorize to authorize your client.

The problem is that http://OAuth_Server/oauth/autorize requires the same credentials you just entered in the http//this_is_my_site/login .

How can I do a redirection to the OAuth Server with custom headers or is this a bad approach?

headers: {
  Authorization: "Basic " + btoa('user' + ":" + 'password')
}

I'm using AngularJS for the frontend and Spring for the backed.

Answer 1

There are two aspects in your question.

First is implementing OAuth. Basically, you redirect client to another side but redirection has backlink to your site. When client authenticates (logs in) on another site, the server redirects client back to your site (using the url your site provided in first redirect) and gives your site TOKEN (in GET parameters). Using this token you can send request to the another site and check if the user os OK.

I've shortcuted some steps but in overall, that's it.

In your case even the user seems to have the same credentials, it is important that he still need to authenticate (authorise your site) on provider. There is no way to workaround this as it was intentionally designed in such way that the client should not be able to enter the credentials of another site on your site and still have the access to other site's data.

Second, is sending custom headers to another site while redirecting. It is not possible mainly because it is a historical limitation. Originally the redirection happens by sending Location header to client with new URL and the client requests new resource via GET. As simple as that. Later the JavaScript redirection was added by AFAIK, nobody really care about the headers as it was not possible anyway so why bother?

However, there is one important exception for this rule - authentication. You can add user and password in the URL as http://user:password@host/... and they will be send in Authenticate header. However, it has nothing in common with OAuth and is called HTT Basic Authentication. If the server supports it, you can specify them during redirection, but it is orthogonal to OAuth.