Node.js authentication REST api and oauth2

Question

I have a few questions:

1) Is it good practice to use the REST API both for external use of the API and for the server side for the base (or plain js) interface? I think it is much easier to encode one REST API server and use it as a backend.

2) If I write my webapp authentication using oauth 2 standard, is this a good way to keep my secret token in a cookie? I think this will lead to CSRF vulnerability.

As I can see, the .js passport uses cookies to store a secret token, for example, for Facebook or Twitter ... How about CSRF in this case?

Answer 1

This is a very interesting question, I am surprised that no one has answered yet.

1) To the first question, my answer is definitely yes ! You do not want to write API logic 2 times.

What you can do is use different URLs.

Eg. For public api you use http://api.domain.com/objects/ , while relatively internal, you can use http://domain.com/api/objects/ or whatever you prefer.

Then you use the same logic, but with different authentication strategies. Public with an authentication token, like many popular APIs (Twitter, Facebook, etc.) and Private using passport.js logs.

Good thing about sharing:

• You share security concerns.
• You can control access bandwidth if your application transfers a lot of data (and you want to give higher priority to your application ... well, maybe!)
• Or you can just control authorization (e.g. DELETE via an open API)

2) I am not a security guru, but I would definitely trust the passport.js authentication system, since it is widely used when using node as a backend.

You can refer to this question for implementing CSRF security in express: How to implement CSRF protection in Ajax calls using express.js (look for a complete example)?

Or another strategy is to use an update token if you use FB or Twitter strategies.

Hope this helps.