Securing a SPA with Spring Boot, OAuth, and JWT?

3
votes

I've been going through this tutorial which shows how to secure a single page application using several scenarios going from simple to our own Authorization Server that delegates authentication to a provider. The first scenario uses the Authorization Code Grant to log the user in.

Suppose we replace Facebook's OAuth Server with our own in this case and configure it to return a JWT token.

Which OAuth flow should the SPA use if it wants to use the JWT token to secure requests through an edge server that load balances between resources servers?

Also how should spring boot / spring security be configured if we want to use the JWT token to replace the replace the default JSESSION and CSRF support in spring? IIUC the JWT token can be used as a replacement to both of these features.

Update

Based on Manish's answer assuming we are using OAuth 2 implicit flow we:

  • Put the @EnableResourceServer annotation on the Resource Server
  • Use an OpenID Connect client to implement the implicity flow

So once this is done are POST request secure assuming each request includes the JWT token as a Bearer Header, or do we need to also configure CSRF?

1
spring-mvcspring-securityoauthspring-cloudnetflix-zuul

1 Answers

2
votes

It will depend on how much your application is sensitive to security but Implicit flow is recommended for pubic client (SPA).

Tutorial is based Authorization Code flow and if you will replace Facebook with your STS, it will still use Authorization Code flow because @EnableOAuth2Sso store the JWT token on server and send the cookie to browser and it also uses refresh token to get the new JWT token. It is a customize flow to implement the Authorization Code flow with public client (SPA) based on API gateway pattern.

To implement the implicit flow - Do not use the @EnableOAuth2Sso at server side, just expose the REST API and secure it with @EnableResourceServer. And you need to use the oidc-client to implement the implicit flow link is here https://github.com/IdentityModel/oidc-client-js

CSRF protection is only required if you will store JWT token or session identifier in the browser's cookie.