I'm developing an whole ecosystem with an OAuth2 Provider, a Backend Server and a Frontend Server.
- OAuth2 Provider: provide only the authentication/authorization for the user, and a few other general purpose service.
- Backend Server: Implement all the logic and the models for a specific context, and is a OAuth2 client. Is registered on the provider and has all the right to use its APIs.
- Frontend Server: Expose a web GUI on the internet and get all the data from the Backend server.
By now, OAuth process works well, and after the authorization, the Backend server can get user data from the provider.
But I need to keep separation from frontend and backend , and I'm going to provide a RESTful API service accessible only from the frontend. My problem is HOW to do this in a correct and secure way.
I'm having some problem while I'm trying to make user authenticate in the Frontend using the OAuth provider session, and make it access to it's data.
This is some requirement:
- frontend need to access to OAuth2 user data through backend API.
- frontend and backend should be on different server, and could be on different host.
- on future I'll introduce more server that use OAuth service.
what's the best architecture for this needs?
The HTTPS part is clear, I'll certainly use it.
I know the OAuth2 flow, but I'm not sure if you example fits my needs. Here's a really simple flow of a real use case. Suppose that the user is already logged in, and has already authorized the "Backend Server" (C). A request to B the html profile page, B need to retrieve the A's information from C using the REST API. C is the OAuth client, and have to be authorized from A to reade it's data. So C ask to D (the OAuth provider) the information, and all the data is returned back to B, that generate the html profile page.
My big doubt (and the reason of this question) is the follow: C is a RoR server that check if the session with the authenticated user is active before to manage the request. But when the request come from a server there's no session on the request, and even if B move the headers to C, C responde with an error, becouse can see that the session is note "clear".
My doubt is that I'm missing the correct way to handle the B-C comunications.