Implement the sample showing the implementations of the recommendations in https://tools.ietf.org/html/draft-ietf-oauth-browser-based-apps-07#section-6.2

Open
#4 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
java, spring
Domain
authentication, backend, security

Research direction

Start by reading section 6.2 of the linked RFC and reviewing the repository's existing samples to identify where an OAuth2 backend implementation belongs. The completed work should provide a sample and documentation covering the confidential backend, Authorization Code with PKCE, browser session cookie, and how the recommendation applies to JWT-based OAuth2.

Written by the indexing model from the issue text.

Description

Expected Behavior

The RFC https://tools.ietf.org/html/draft-ietf-oauth-browser-based-apps-07 recommends use of:

JavaScript Applications with a Backend

The Application Server (Backend) SHOULD be considered a confidential client,
and issued its own client secret. The Application Server SHOULD use
the OAuth 2.0 Authorization Code grant with PKCE to initiate a
request for an access token.
Security of the connection between code running in the browser and
this Application Server is assumed to utilize browser-level
protection mechanisms. Details are out of scope of this document,
but many recommendations can be found in the OWASP Cheat Sheet series
(https://cheatsheetseries.owasp.org/), such as setting an HTTP-only
and Secure cookie to authenticate the session between the browser and
Application Server.
In this scenario, the session between the browser and Application
Server SHOULD be a session cookie provided by the Application Server.

Current Behavior

I have not seen any samples and/or documentation explaining how to implement the recommendation especially when using JWT tokens. It will be good if the documentation discusses if the above recommendation is applicable when using JWT token with OAuth2.

Context

Dominant language
Java
Stars
1.8k
Forks
797
Avg merge
3m
Merged PRs (30d)
5

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from spring-projects/spring-security-samples

All issues in spring-projects/spring-security-samples

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.