Javascript / OAuth2 prototype
Budget: $250 – $750 USD
Looking for a seasoned JavaScript developer to help me learn best practices for managing authorization tokens at the application level. I have no experience developing front end applications but have extensive experiences on the back end.
Specifically, I need some help understanding how to implement a JavaScript application that uses token based OAuth2, either an implicit grant flow or an authorization code flow with proof key. I have an AWS Cognito service stood up, and can provide the URL to the provided Cognito login page, an application public key, and a valid username + password. I'd like to use custom OAuth2 scopes.
One we have a JWT authentication token, we will use it to call a few different test REST endpoints that are running on AWS API Gateway. The authentication on the API endpoints will use the custom scopes defined in the authorization token.
My goals are to understand the authorization token lifecycle:
1. Any JavaScript libraries used to manage authentication tokens acquired via OAuth2.
2. How tokens are stored after initial authentication.
3. How the tokens are retrieved for subsequent REST API calls.
4. How tokens are managed up through expiration
5. Best practices around logout / interrupted browser sessions, etc.
6. How multiple tokens can be managed for the same authentication service / different authentication services.
In addition, any other lessons learned from production deployments using OAuth2 and the tradeoffs encountered would be welcomed.
Deliverables:
1. a two-page JavaScript application that
1A. Consist of a 'welcome page' that integrates the Cognito login page endpoint using a provided (Cognito) URL, an application public key and hardwired scopes.
1B. Upon successful login, redirects to a second page that consists of three buttons: the first two will invoke two different provided REST endpoints, one of which is authorized using a custom scope (should result in a 200), the other is not (should result in a 401). The URL to both endpoints will be provided and will consist of trivial 'hello world' type GETs.
1C. The third button will be a logout button
1D. Properly handles expired tokens (redirects?)
1E. Property handles the tokens in a logout scenario and executes a logout redirect.
2. Instructions on how to deploy the above either locally on a development machine, or on a third-party app hosting service.
The delivery mechanism for the above will be a public GitHub repository.
If this initial project is successful, we can continue to refine to demonstrate more complex OAuth2 scenarios.
Specifically, I need some help understanding how to implement a JavaScript application that uses token based OAuth2, either an implicit grant flow or an authorization code flow with proof key. I have an AWS Cognito service stood up, and can provide the URL to the provided Cognito login page, an application public key, and a valid username + password. I'd like to use custom OAuth2 scopes.
One we have a JWT authentication token, we will use it to call a few different test REST endpoints that are running on AWS API Gateway. The authentication on the API endpoints will use the custom scopes defined in the authorization token.
My goals are to understand the authorization token lifecycle:
1. Any JavaScript libraries used to manage authentication tokens acquired via OAuth2.
2. How tokens are stored after initial authentication.
3. How the tokens are retrieved for subsequent REST API calls.
4. How tokens are managed up through expiration
5. Best practices around logout / interrupted browser sessions, etc.
6. How multiple tokens can be managed for the same authentication service / different authentication services.
In addition, any other lessons learned from production deployments using OAuth2 and the tradeoffs encountered would be welcomed.
Deliverables:
1. a two-page JavaScript application that
1A. Consist of a 'welcome page' that integrates the Cognito login page endpoint using a provided (Cognito) URL, an application public key and hardwired scopes.
1B. Upon successful login, redirects to a second page that consists of three buttons: the first two will invoke two different provided REST endpoints, one of which is authorized using a custom scope (should result in a 200), the other is not (should result in a 401). The URL to both endpoints will be provided and will consist of trivial 'hello world' type GETs.
1C. The third button will be a logout button
1D. Properly handles expired tokens (redirects?)
1E. Property handles the tokens in a logout scenario and executes a logout redirect.
2. Instructions on how to deploy the above either locally on a development machine, or on a third-party app hosting service.
The delivery mechanism for the above will be a public GitHub repository.
If this initial project is successful, we can continue to refine to demonstrate more complex OAuth2 scenarios.