Java Spring Boot OAuth2 Social and JWT authentication project set up -- 2
Budget: $30 – $250 USD
We are trying to secure a REST API written in Spring boot which will be accessed by an Android app as well as from a SPA (web) and we need to secure it as follows:
For Android App:
1. The app uses google_sign_in Flutter plugin. The user will login inside the app into their Google account using OAuth2. The app will then get the Access Token from google and call the "/register" endpoint with that access token. (Note that this is *NOT* Authorization Code Grant flow).
Spring security will take that Access Token and get the user profile details from Google. If successful, the a user row will be created in the db (if not created previously) and return a custom JWT. The app will store this JWT for future requests.
2. For all other end points (for example, /data) , the app will send the JWT that it received in step 1 as Authorization header. Spring security will check this JWT, validate the token, authenticate the user and return appropriate response. Otherwise return Unauthorized.
3. For SPA , the same API needs to be secured using OAuth2 "Authorization Code Grant" flow. Upon calling /register, the app will be redirected to Google Auth server and procure an Auth Code, which will be sent to Spring security. Spring security will exchange the authcode for auth token and the same process as in Step 1 and step 2 will be followed.
What we need:
A starter spring boot project that implements the above logic and secures a sample end point /data. The actual data returned is not important.
Requirements: Use latest spring boot version, mysql db, Eclipse ide, and Maven.
Note: In no case, will the user be sending their emailid/password to the Spring server. User's emailid will be retried by spring security from Google server using Auth Token in /register endpoint.
Please bid only if you are a Spring Security expert.
For Android App:
1. The app uses google_sign_in Flutter plugin. The user will login inside the app into their Google account using OAuth2. The app will then get the Access Token from google and call the "/register" endpoint with that access token. (Note that this is *NOT* Authorization Code Grant flow).
Spring security will take that Access Token and get the user profile details from Google. If successful, the a user row will be created in the db (if not created previously) and return a custom JWT. The app will store this JWT for future requests.
2. For all other end points (for example, /data) , the app will send the JWT that it received in step 1 as Authorization header. Spring security will check this JWT, validate the token, authenticate the user and return appropriate response. Otherwise return Unauthorized.
3. For SPA , the same API needs to be secured using OAuth2 "Authorization Code Grant" flow. Upon calling /register, the app will be redirected to Google Auth server and procure an Auth Code, which will be sent to Spring security. Spring security will exchange the authcode for auth token and the same process as in Step 1 and step 2 will be followed.
What we need:
A starter spring boot project that implements the above logic and secures a sample end point /data. The actual data returned is not important.
Requirements: Use latest spring boot version, mysql db, Eclipse ide, and Maven.
Note: In no case, will the user be sending their emailid/password to the Spring server. User's emailid will be retried by spring security from Google server using Auth Token in /register endpoint.
Please bid only if you are a Spring Security expert.