0

I have an angular application, which is querying an API as a client (written on Spring Boot 2.2.1 + Spring 5.2.1) that supports 3rd party authentication over OAuth2. The API has altogether 3 different authentication strategies namely,

  1. Username + Password - For initial authentication. Upon successful authentication, the user will be issued with a JWT.
  2. 3rd Party Authentication - For initial authentication. Users can connect via Google, facebook and github. Upon successful authentication, the user will be issued with a JWT.
  3. JSON Web Token - All subsequent requests are authenticated by the JWT, that is valid for 30 minutes.

Now, for the case of issuing a JWT upon successful authentication via a 3rd party provider, is where I have a problem with. I am able to successfully generate the JWT at the server, but I am unable to figure out a way to pass the JWT string to the angular application. All I have seen so far it sending this token string as a URL query parameter, which is obviously unsafe, as URLs are visible in plain.

My question is what is the best solution for this problem? In fact, how should I send the JWT generated in the BE to the client in a safe way?

P.S: I am deliberately omitting any code snips to shorten the question. If it is required to look into code snips please comment and I will update the question.

Improve this question
3
  • I assume you're contacting the API via an HTTP request... Why not send the token in the body of the HTTP response?
    – ZX9
    Dec 10, 2019 at 2:34
  • @ZX9 Thanks for your response. That doesn't seem like something feasible though, as the API sends a redirect to the client.
    – Romeo Sierra
    Dec 10, 2019 at 6:15
  • You could send it as Authorization http header to angular
    – Brooklynn99
    Mar 26, 2022 at 0:06

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy