I have an angular application, which is querying an API as a client (written on Spring Boot 2.2.1 + Spring 5.2.1) that supports 3rd party authentication over OAuth2. The API has altogether 3 different authentication strategies namely,
- Username + Password - For initial authentication. Upon successful authentication, the user will be issued with a JWT.
- 3rd Party Authentication - For initial authentication. Users can connect via Google, facebook and github. Upon successful authentication, the user will be issued with a JWT.
- JSON Web Token - All subsequent requests are authenticated by the JWT, that is valid for 30 minutes.
Now, for the case of issuing a JWT upon successful authentication via a 3rd party provider, is where I have a problem with. I am able to successfully generate the JWT at the server, but I am unable to figure out a way to pass the JWT string to the angular application. All I have seen so far it sending this token string as a URL query parameter, which is obviously unsafe, as URLs are visible in plain.
My question is what is the best solution for this problem? In fact, how should I send the JWT generated in the BE to the client in a safe way?
P.S: I am deliberately omitting any code snips to shorten the question. If it is required to look into code snips please comment and I will update the question.