Skip to main content

OAuth2 Authorization Code flow without client secret using WSO2 Identity Server




Quoting from https://aaronparecki.com/oauth-2-simplified/

Single-page apps (or browser-based apps) run entirely in the browser after loading the source code from a web page. Since the entire source code is available to the browser, they cannot maintain the confidentiality of their client secret, so the secret is not used in this case. The flow is exactly the same as the authorization code flow above, but at the last step, the authorization code is exchanged for an access token without using the client secret. 
Note: Previously, it was recommended that browser-based apps use the "Implicit" flow, which returns an access token immediately and does not have a token exchange step. In the time since the spec was originally written, the industry best practice has changed to recommend that the authorization code flow be used without the client secret. This provides more opportunities to create a secure flow, such as using the state parameter. References: Redhat, Deutsche Telekom, Smart Health IT.


I wanted to see how easy it would be to support this with WSO2 Identity Server without touching or patching the product code.

Turns out it wasn't that hard thanks to the extension points :)

Here's my attempt.
https://github.com/mefarazath/Authorization-Grant-Without-Client-Secret

Comments

Post a Comment

Popular posts from this blog

OAuth - Playing Ping Pong for Authorization

You probably would have heard the word OAuth more than a few times. Ever wondered what that is? do we use that at all?. Guess what we make use of OAuth almost everyday.I got the opportunity to learn about OAuth during my time at WSO2 Identity Server team. Here's the first step of conquering OAuth :) What Exactly is OAuth? Let me start with OAuth,  OAuth solves the problem of allowing third party entities( eg: applications) to access a resource owner's protected resources without actually giving away your valuable credentials like passwords.  Let's think of it this way. You have a facebook account(Assuming you have one :P) which is your protected resource and you are the resource owner . Now you get a little high and decide to try out one of these fancy Facebook apps that finds your soul mate. The app now becomes the third party application which requires access to read out your friend list from your profile which is the protected resource. Suppose you don't ...
5 comments
Read more

Hello World

            I have been keen on wanting to blog for a long time, but i guess now is the time to do so. Blogs are a great way to share stuff with people so writing one isn't a bad idea. Blogs have been lifesaver for so many nagging problems I have faced during my entire life, so i guess its time for me to payback. Just like a baby would cry out when it comes out to the world, a programmer would essentially write out a line "Hello World!!!" to start off coding in any language( Well at least i do that still :P and I think I am a programmer too :P). Writing about tech stuff hasn't been my forte either but nevertheless I love writing. So let me start off with a big "Hello World !!!"            
1 comment
Read more