Can I use a session cookie for API authentication?

Question

I want to build a web application with a Single Page Application as the front end and an API as the back end. The front-end SPA will read and write data to the API.

The SPA and the API will be hosted on two different domains:

• SPA: https://my-spa.com
• API: https://my-api.com

The API needs to be private so only authenticated users can use it.

I wonder if I should use a simple cookie session mechanism or OAuth for the authentication. Oauth seems to be the standard for this kind of app, but it also seems more prone to security breaches because it is more complex to implement.

My questions:

1. Can I use a simple session cookie, or is there any technical blocker for it? By session cookie, I mean having a sign-in endpoint that will generate and save a random string in the database and set it as a cookie. Then in each API request, I would get the user information from the database using the session cookie random string to manage permissions. I understand the session cookie should be set with the secure and sameSite=None attributes because the SPA and the API are not on the same domain. Is that a problem?

2. Why OAuth seems more used in this situation if it is more complex to implement and could lead to more security issues?

Answer 1

You can and some systems do use this method, but it has some flaws you will have to deal with.

1. You will need to expire it to avoid man in the middle attacks gaining permanent access.
2. You will need to validate it against a central database or service. This limits your scalability.

OAuth addresses these and other concerns. There are many existing libraries that implement it, so you don't have to write it all you self and risk mistakes.