I want to build a web application with a Single Page Application as the front end and an API as the back end. The front-end SPA will read and write data to the API.
The SPA and the API will be hosted on two different domains:
The API needs to be private so only authenticated users can use it.
I wonder if I should use a simple cookie session mechanism or OAuth for the authentication.
Oauth seems to be the standard for this kind of app, but it also seems more prone to security breaches because it is more complex to implement.
Can I use a simple session cookie, or is there any technical blocker for it? By session cookie, I mean having a sign-in endpoint that will generate and save a random string in the database and set it as a cookie. Then in each API request, I would get the user information from the database using the session cookie random string to manage permissions. I understand the session cookie should be set with the secure and sameSite=None attributes because the SPA and the API are not on the same domain. Is that a problem?
Why OAuth seems more used in this situation if it is more complex to implement and could lead to more security issues?