OAuth Assisted Token Flow for Single Page Applications
summary
Describes the ASSISTED TOKEN flow: a new OAuth endpoint that returns an access token into a hidden iframe and passes it to the page with postMessage, requiring only client_id and making scopes optional (unset means all client scopes). Authentication happens inside the iframe, the page shows a modal when needed, and token persistence is handled server-friendly via cookie storage so the authorization server can enforce short-lived scope changes. Demo uses jQuery and claims about eight lines of integration code; draft lives at IETF 101.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:36OAuth Implicit Load
- 5:50The Problem
- 7:18The Flow
- 10:17Scopes
- 13:19Security
- 14:10Post Message
- 14:52Cookie Storage
- 15:31Valid Token
- 17:03OAuth Handles
- 17:48Implementation
- 18:54Conclusion
related talks
37mOAuth2 and OpenID Connect for Single Page Applications
40mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
01h 00mOAuth – the good Parts
59mSecuring Web APIs from JavaScript/SPA Applications
44mThe Art of Authentication for Web Apps
01h 00mSupercharging OAuth 2.0 Security
26mSecuring Single Page Applications with Token Based Authentication
29mKnock knock, who's there? Authenticating your single page apps using JSON Web Token