I want to build a web application with a Single Page Application as the front end and an API as the back end. The front-end SPA will read and write data to the API.

The SPA and the API will be hosted on two different domains:

  • SPA: https://my-spa.com
  • API: https://my-api.com

The API needs to be private so only authenticated users can use it.

I wonder if I should use a simple cookie session mechanism or OAuth for the authentication. Oauth seems to be the standard for this kind of app, but it also seems more prone to security breaches because it is more complex to implement.

My questions:

  1. Can I use a simple session cookie, or is there any technical blocker for it? By session cookie, I mean having a sign-in endpoint that will generate and save a random string in the database and set it as a cookie. Then in each API request, I would get the user information from the database using the session cookie random string to manage permissions. I understand the session cookie should be set with the secure and sameSite=None attributes because the SPA and the API are not on the same domain. Is that a problem?

  2. Why OAuth seems more used in this situation if it is more complex to implement and could lead to more security issues?

1 Answer 1


You can and some systems do use this method, but it has some flaws you will have to deal with.

  1. You will need to expire it to avoid man in the middle attacks gaining permanent access.
  2. You will need to validate it against a central database or service. This limits your scalability.

OAuth addresses these and other concerns. There are many existing libraries that implement it, so you don't have to write it all you self and risk mistakes.

  • Thanks. So setting the SameSite=None attribute on the session cookie isn't an issue? Dec 22, 2022 at 14:52
  • If you don't know for sure, you shouldnt be writing it
    – Ewan
    Dec 22, 2022 at 17:57
  • @DamienMonni Note that SameSite affects behaviour of sub-requests (e.g. if your site is included in a frame, or fetch() requests). It does not provide a way to implement third-party cookies. See developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/… . Using the Authorization header would give you more control than relying on cookies.
    – amon
    Dec 24, 2022 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.