1

This is my actual OAuth2 architecture:

enter image description here

I used this example to build it.

Lets call the servers:

  • RS: Resource Server
  • AS: Authorization Server

The resource server has the protected /resource, after manually obtaining a token from the Authorization Server I can access the protected resource:

$ curl -H "Authorization: Bearer $TOKEN" http://RS/resource
$ Hi from  resource server db9096ea-698e-4fc2-a0f9-4af6ab65ca30

So far so good, the data from the protected RS/resource is obtained.

Now, in my Angular/Node app when I press the login button a http://RS/login request will be fired, this is the flow:

  1. http://RS/login : http 302, redirection to the AS.
  2. http://AS/uaa/oauth/authorize?client_id=acme&redirect_uri=http://RS/login&response_type=code&state=nTFE9R : The user log in and the code is obtain, a http 302 is fired.
  3. http://RS/login?code=7kQJ2G&state=nTFE9R : Http 302, is returned to the RS.
  4. http://RS/ : Is redirected to the root of the RS, but with an http 401 Unauthorized.

If you see, I never obtained access to the http://RS/resource from the Angular/Node app. In fact my address change to http://RS/ in my browser.

Do you know how can I obtain access to the protected resource from my Angular Node App?

Community
  • 1
  • 1
Coyolero
  • 2,353
  • 4
  • 25
  • 34

0 Answers0