2 ms·
My problem is that my use case is always this: by default the application should be it's own OAuth server, so the endpoints can use OAuth against the applicatio
by XorNot 2y ago
My problem is that my use case is always this: by default the application should be it's own OAuth server, so the endpoints can use OAuth against the application and a local only database.
Then I want an easy story for linking that instead to LDAP for corporate deployments, or to an SSO OAuth server.
The problem is...well I still don't really know how I should be including that? It's so much easier just to register a session cookie from a login page.
- jpc0 2y ago> The problem is...well I still don't really know how I should be including that? It's so much easier just to register a session cookie from a login page. For a webpage this makes perfect sense, where would you securely store an access / refresh token on web that isn't vulnerable to XSS? In a session cookie that is secure & http only... For native apps though that state might be more annoying to track and a auth token and refresh token is pretty easy to store securely.