What is the correct way to request from a mobile app with password grant type?

Question

Currently I have a mobile app, consuming restful web api (jwt) from a monolithic jhipster backend successfully, now I am porting the monolithic backend to microservices, and there are already registry (jhipster registry v4.0.3), gateway (angular 6), uaa (jhipster UAA) and a microservice generated.

Then I compiled and sent a /auth/login request from postman to gateway, but failed, below is the details of the request: url: post

localhost:8080/auth/login

header:

Accept: application/json

and

Content-Type: application/json

body as raw:

{"username":"admin","password":"admin"}

the response is:

{
    "error": "access_denied",
    "error_description": "Invalid CSRF Token &#39;null&#39; was found on the request parameter &#39;_csrf&#39; or header &#39;X-XSRF-TOKEN&#39;."
}

What is the correct way to request from a mobile app with password grant type? I need oauth 2 (such as refresh token. etc).

Not sure what I missed something, I checked the docs, and did not find something useful.

Feel very appreciated for any help.

Note: the gateway works well (from browser), the gateway, uaa and the microservice are also registered to the registry successfully.

I think it is not a duplicate with other question, because mobile app use token based authentication, the csrf is not necessary in this case.

Possible duplicate of Authentication to JHipster UAA from non-jhipster application — Jon Ruddell
Thank you, Jon. I add a "rememberMe" with true, but the error is still there, in my case, there is no cookie and csrf token to be attached to the request. The login dialog is not from the server, but made with android/ios native code. — James Hao
The rememberMe is not important. You need to get a cookie with the XSRF token first before you can login (I think you can get one by making a GET request, the webapp requests /api/account on page load). I'm not sure how you handle cookies in native app code though. Here's how I map the cookie to a request header for React Native, it's not what you're looking for but it might help github.com/ruddell/ignite-jhipster/blob/… — Jon Ruddell
I think your suggestion should work and I will try. just curious why need cookie and xsrf in this case. it is not part of oauth 2, right? — James Hao
The cookie should be session based, request from mobile should be the token based. — James Hao

James Hao James Hao · Accepted Answer · 2019-02-07T15:16:29

Create another gateway for mobile without front-end application like angular or react. please using below command:

c:/>jhipster --skip-client

choose jhipster registry, uaa, no database, etc

This link has details for this pattern.

What is the correct way to request from a mobile app with password grant type?

1 Answers