Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, etc., I doubt if these are really required for our intended use. I think that the simpler implementation described below might do the job as well, extending our existing session-based login mechanism.
More exactly, we want to achieve the following:
- The user has an account for our web application our-app.com, and is logged in.
- The user visits their-app.com (in the same browser).
- The user agrees to share her/his data with their-app.com.
- Now, their-app.com can make authenticated cross-origin AJAX API requests to our-app.com. Since the browser sends the existing session cookie, no separate login is required if the user is already logged in on our site.
Can you please review my suggested implementation, and point our security flaws or other disadvantages? What benefits would we get from using e.g. OAuth instead?
- Their-app.com registers for using our API. As a result, "their-app.com" is added as an allowed CORS origin to our database.
- A user visits their-app.com in her/his browser.
- TheirApp requests https://our-app.com/me to find out is the user is logged in.
- Technically, this is a "withCredentials" AJAX request.
- Since their-app.com is a registered origin, this cross-origin API call is allowed by our web servers. (All CORS requests from an unknown origin another-app.com would be rejected.)
- If the user is not logged in, or if the user is logged in but did not yet grant access to their-app.com, the response will include a URL. This URL points to our login page (say, https://our-app.com/login?origin=their-app.com). TheirApp should then open this link in a new tab, to allow the user to login.
- The login page will ask for username/password (if not yet logged in), resulting in a session cookie being set, and then ask something like "Do you want to allow their-app.com to access your data?" Since all this happens in a separate tab, the password is safe from being observed by their-app.
- If the user grants access, an entry ("their-app.com", userID) is added to the database, to remember her/his decision.
- All cross-origin requests to our API are handled this way:
- First look up if the origin is registered. If not, reject.
- Then look up the user's session if a session cookie was provided.
- If a user is logged in, but did not yet grant access to the origin, we reject the request, returning a link as described above.
- If a user is logged in, and has already granted access to the 3rd party, then we process the request in the same way as same-origin requests from our own web app.
- If not logged in, only public data can be accessed.