I'm building a web app in javascript which works offline, uses local storage, and communicates with an API on the same domain. I would like users to be able to perform initial authentication (username and password) and then perhaps periodic authentication every 10 days or so, and I would like to use OAuth to do this. I would like to use 2-legged authentication as I don't want the user to have to confirm access after authenticating. However, I know a secret cannot be stored securely in javascript, so is this possible? If it is, how might I go about achieving it?
Add a comment
|
1 Answer
Yes, you can use Resource Owner Password Credentials grant type to achieve this. It's a simple HTTP POST to an OAuth Authorization Server with client_id, grant_type, username and password. What comes back is the access_token and some meta data about it (type, expiry, refresh token). The refresh token could be used to request fresh access tokens for your "10 days" scenario, the access token may be more appropriate for a few minutes (session timeout).
Client authentication (with a client_secret) is optional for this grant type.
