How to store access token in cookies in OAuth2?

Question

In my current project, I am using OAuth2 for token-based authentication in order to access the Rest APIs, but these tokens are readable by js. Because of this and a couple of other reasons I wanted to store the access token in cookies.

I have gone through the internet and could not find a way to put tokens in cookies. Can someone please help me with this?

Answer 1

Finally, found a solution for this. I have created a /login API where I am setting access token in cookies.

@PostMapping(consumes = "application/json")
public ResponseEntity<?> login(@RequestBody LoginRequest loginRequest,
                               HttpServletResponse httpResponse) throws Exception {

    ResponseEntity<?> result = null;
    try {
        String url = UriComponentsBuilder.fromHttpUrl(environment.getProperty("oauth.token.url"))
                .queryParam("username", loginRequest.getUsername())
                .queryParam("password", loginRequest.getPassword())
                .queryParam("grant_type", OauthConstants.GRANT_TYPE_PASSWORD)
                .toUriString();

        HttpHeaders headers = new HttpHeaders();
        headers.setAccept(Arrays.asList(MediaType.APPLICATION_JSON));
        headers.add(AppConstants.AUTHORIZATION_HEADER, AppConstants.AUTH_HEADER_CLIENT_DEFAULT);
        HttpEntity<String> httpEntity = new HttpEntity<>(headers);

        ResponseEntity<HashMap> response = restTemplate.exchange(url, HttpMethod.POST, httpEntity, HashMap.class);
        Map<String, Object> authMap = response.getBody();

        logger.info("Adding cookies");
        String accessToken =  (String) authMap.get(AppConstants.ACCESS_TOKEN);
        String refreshToken =  (String)authMap.get(AppConstants.REFRESH_TOKEN);

        List<Cookie> cookies = new ArrayList<>();
        cookies.add(newAppCookie(AppConstants.ACCESS_TOKEN, accessToken));
        cookies.add(newAppCookie(AppConstants.REFRESH_TOKEN, refreshToken));
        
        cookies.stream().forEach(c -> httpResponse.addCookie(c));
        logger.info("Cookies added successfully");
        result = ResponseEntity.ok(authMap);
    } catch (HttpClientErrorException hex) {
        logger.error("HttpClientErrorException occurred in login(): ", hex);
        result = new ResponseEntity<>(hex.getResponseBodyAsString(), 
                HttpStatus.UNAUTHORIZED);
    } catch (Exception e) {
        logger.error("Exception occurred in login(): ", e);
        throw e;
    }
    return result;

And after user logs in, for every API request to server a Filter is applied to check the access token in the cookies is valid or not as shown below.

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class ApplicationOAuthFilter implements Filter {

private static final Logger logger = LoggerFactory.getLogger(AuthFilter.class);

@Autowired
private Environment environment;

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {


    HttpServletRequest httpRequest = (HttpServletRequest) request;
    if (httpRequest.getRequestURI().equals("/oauth/token")||
    httpRequest.getRequestURI().equals("/login")) {
        chain.doFilter(request, response);
        return;
    }

    Cookie[] cookies = httpRequest.getCookies();
    if (cookies == null) {
        logger.info("No Cookies found");
        chain.doFilter(request, response);
        return;
    }
    
    Map<String,String> cookiesMap = Arrays.asList(cookies).stream().collect(Collectors.toMap(Cookie::getName, Cookie::getValue));
    if (!cookiesMap.containsKey(AppConstants.ACCESS_TOKEN)) {
        logger.info("No Access token found in cookie");
        chain.doFilter(request, response);
        return;
    }

    ApplicationRequestWrapper mutableRequest = new ApplicationRequestWrapper(httpRequest);
    mutableRequest.putHeader("Authorization","Bearer "+ cookiesMap.get(AppConstants.ACCESS_TOKEN)); 
    logger.info("Access token found in cookie");
    chain.doFilter(mutableRequest, response);
}