A $.ajax wrapper for OAuth 2 access and refresh token management for use in a SPA.
This is a library for storing access token client side and use it for $.ajax requests. Secondly, it is a library for requesting new access tokens upon expiration.
I have written an extensive blog post about writing a web app using Lumen that utilizes this library for client side management of tokens.
- Stores access token client side using store.js for persistence between refreshes
- Adds authorization header to ajax requests
- Adds CSRF token to header requests if provided to protect access token
- When access token expires all 401 requests are buffered and fired after a new access token is generated by using refresh token server side
- Works with AMD modules
Can be installed via bower package
bower install --save jquery-oauth-spiria
... or by NPM
npm install --save jquery-oauth-spiria
... or by grabbing a zip of the latest release
Have an endpoint that issues access tokens. Remember do NOT send
client_secret with the request.
Send the request to a proxy endpoint that sends the request to the OAuth endpoint. Remember do NOT save the refresh
token client side. Save this as an encrypted httponly cookie and use a proxy to send this to the OAuth endpoint when
refreshing access tokens.
Example of resource owner implementation in a SPA
Somewhere where things are initialised
Login form (when form is submitted)
These calls are available through auth
The library addresses OAuth problems in general. Many of these are outlined in this great article: OAuth2 with Angular the right way
Also, the refresh token functionality takes great inspiration in this great AngularJS library: angular-http-auth
Copyright © 2015 Esben Petersen & Contributors
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at: http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.