I have a scenario I am considering, and I don't quite find out what's the best solution with OAuth. Hopefully I can learn good things here.
- We are company A and we specialize in managing secure text notes.
- They are company B.
- Company B has users that access Company B site. Sometimes they authenticate, sometimes they don't.
- Company B's users need a service to create and read text notes that Company B doesn't provide.
- Company B hires company A to provide that service to their users.
- We, company A, provide company B with a HTML + Javascript widget they can embed on their website, so that their users can use our functionality through Company B's site as if we didn't exist. We can provide the same widget to othher companies also, so it's kind of generic.
- The widget we provide to Company B will access our services (Resource API), so we need to ensure these requests are coming from a legit client
- We register the widget we provide to Company B as a client in our Identity server, with a client Id and a secret, and we provide that information to Company A so that they can retrieve an access token for their widget when their site loads at any user's browser.
- When their users interacts with the widget, the widget is sending requests to our Resource API bearing the client access token, so that we know that the request should be authorized and is coming from Company B site.
- A user accesses Company B site, the widget loads, and the user interacts with it to retrieve his notes, if any.
I have several concerns about this scenario and how could we deal with it.
- We could keep track of Company A's users by storing their unique Id (e.g: email) and the text notes for that email. But we can only trust what Company A tells us about that user, whether is really authenticated in their system or not. To us, the Company A's user is just an email, whether legit or not.
- We could restrict access to our API to only allow requests from Company B borrowed widget (which is actually our widget, but embedded in their site). But we cannot really know if the widget is requesting his own text notes or someone else's text notes.
In other words, a Company A user (e.g: [email protected]) could view/steal the access_token by checking his browser's http requests and seeing the Authorization header. And they could use that access_token to view the text notes for a different user (e.g: [email protected]), wouldn't he?
How could I approach this scenario with a more secure mechanism? I feel I'm missing something important on this puzzle.