Share access token between frontend and backend

API Discussion
1

Hello :slight_smile:

I am developing an application where I use the oauth2 blizzard to manage user authentication (because the application is reserved for wow players).

The stack was MySQL + Java Spring Boot + React.

I configured Spring Security to handle user login (redirect + endpoint protection). So I can get the user access token in the backen.
I’m doing some API calls with the backend to fetch data for the application logic.

But, I want to do some API calls on the frontend to display information etc … For that I want to share the user access token between the backend and the frontend.

It’s a good idea ? Or do I have to make all API calls with my backend ?

Thanks you very much

Dohakor

2

For security It is generally a bad idea to share any OAuth2 access_token with the front-end as it might get intercepted by 3rd parties.

Beside the security there are a few other things to consider:

  1. Some endpoints (if not all of them) are protected by CORS and will just not work on most scenarios.
  2. You can’t properly handle the 36k req/hour limit from the client-side.
  3. The user access_token gives access to some user’s personal information, that raises some GDPR/privacy concerns.
  4. The API ToS specifically says you should never share your credentials. Since the token is created in the context of your application I assume it includes any token authorizing requests on its behalf.
3

Oh ok
And if i add the oauth2 workflow on the frontend ?
I have a redundancy yes, but i can get the user access token and the token of the application without call the backend of my application.

4

That is even worse, that way you’ll have to expose everything including your own client credentials to the front-end.

5

Oh :’(

have you any recommendation ?

6

You must handle all Blizzard API data on the server-side. Since you already have a server that should be easy to implement.

You can create simple endpoints just to proxy the data. I created this project to handle situations like this: https://gitlab.com/francisschiavo/blizzard-api-proxy

If you look at profile endpoints you’ll see the actual bnet token is mapped to another project specific token, that means the communication from the front-end to the back end will never leak a token that can used to access data directly from Blizzard, keeping the user token and your credentials safe.

7

ok ok :slight_smile:

Thanks you very much for your help !