Authorization code flow for in-browser applications

1. A method comprising:

in an application server:

receiving a request from an in-browser application for an authorization code for a specific user, wherein the in-browser application comprises a Java-Script-based application that runs only inside of a browser;

creating a session that re-directs the in-browser application to an authorization server;

receiving the authorization code from the authorization server by way of the in-browser application;

requesting an access token from the authorization server;

receiving the access token from the authorization server;

managing a secure storage protocol for the access token on the application server;

receiving a request from the in-browser application for a resource;

using the access token to request the resource from a third-party resource server; and

returning the resource to the in-browser application;

wherein the in-browser application communicates with a plurality of end point nodes on the application server.

2. The method of claim 1 , wherein the authorization server comprises one or more of an OAuth1.0 and an OAuth2.0 standard for authorization.

3. The method of claim 2 , wherein the request from the in-browser application for the authorization code comprises a client ID to identify the specific user, a uniform resource locator (URL) to which the in-browser application is re-directed, a scope parameter, and a state parameter.

4. The method of claim 3 , comprising using the URL to which the in-browser application is re-directed, the scope parameter, the client ID, and the state parameter to create the session that re-directs the in-browser application to the authorization server.

5. The method of claim 3 , comprising using a configuration associated with the specific user to provide the URL to which the in-browser application is re-directed, the client ID that identifies the specific user, and a client secret associated with the specific user for use in the request for the access token from the authorization server.

6. The method of claim 1 , wherein the request for the authorization code from the in-browser application is received by an authorization code request endpoint node.

7. The method of claim 1 , wherein the authorization code is received by a callback endpoint node.

8. The method of claim 7 , wherein the callback endpoint node is operable to compare a state parameter received from the authorization server with a state value received from the in-browser application, and to terminate the in-browser application when the state parameter does not match the state value.

9. The method of claim 1 , wherein the request to the third-party resource server is executed by a resource request endpoint node.

10. The method of claim 9 , wherein the resource request endpoint node is operable to persist the access token by recognizing the specific user by a cookie on a web browser that comprises a user ID; to find an access token associated with the user ID; to use the associated access token to access the third-party resource server at a later time for a different resource; to receive the different resource from the third party resource server; and to return the different resource to the in-browser application.

11. The method of claim 1 , wherein the request for the access token from the authorization server is executed without involvement of the in-browser application.

12. The method of claim 1 ,

wherein the requesting the access token from the authorization server comprises receiving a request from the in-browser application at a first request endpoint in the application server;

wherein the receiving the authorization code from the authorization server by way of the in-browser application comprises receiving the authorization code from the authorization server at a second callback endpoint in the application server;

exchanging the authorization code for the access token and securely storing the access token in the application server such that the access token is not shared with the in-browser application;

wherein the receiving the request from the in-browser application for a resource is received at a third resource request endpoint in the application server;

enhancing the request for a resource with the access token;

requesting the resource using the enhanced request;

receiving the resource; and

transmitting the resource to the in-browser application.

13. A non-transitory computer-readable medium comprising instructions that, when executed by a processor execute a process comprising:

in an application server:

receiving a request from an in-browser application for an authorization code for a specific user, wherein the in-browser application comprises a Java-Script-based application that runs only inside of a browser;

creating a session that re-directs the in-browser application to an authorization server;

receiving the authorization code from the authorization server by way of the in-browser application;

requesting an access token from the authorization server;

receiving the access token from the authorization server;

managing a secure storage protocol for the access token on the application server;

receiving a request from the in-browser application for a resource;

using the access token to request the resource from a third-party resource server; and

returning the resource to the in-browser application;

wherein the in-browser application communicates with a plurality of end point nodes on the application server.

14. The non-transitory computer-readable medium of claim 13 , wherein the authorization server comprises one or more of an OAuth1.0 and an OAuth2.0 standard for authorization.

15. The non-transitory computer-readable medium of claim 14 , wherein the request from the in-browser application for the authorization code comprises a client ID to identify the specific user, a uniform resource locator (URL) to which the in-browser application is re-directed, a scope parameter, and a state parameter.

16. The non-transitory computer-readable medium of claim 15 , comprising instructions for:

using the URL to which the in-browser application is re-directed, the scope parameter, the client ID, and the state parameter to create the session that re-directs the in-browser application to the authorization server; and

using a configuration associated with the specific user to provide the URL to which the in-browser application is re-directed; the client ID that identifies the specific user; and a client secret associated with the specific user for use in the request for the access token from the authorization server.

17. The non-transitory computer-readable medium of claim 13 , wherein the request for the authorization code from the in-browser application is received by an authorization code request endpoint node.

18. The non-transitory computer-readable medium of claim 13 ,

wherein the authorization code is received by a callback endpoint node; and

wherein the callback endpoint node is operable to compare a state parameter received from the authorization server with a state value received from the in-browser application, and to terminate the in-browser application when the state parameter does not match the state value.

19. The non-transitory computer-readable medium of claim 13 ,

wherein the request to the third-party resource server is executed by a resource request endpoint node; and

wherein the resource request endpoint node is operable to persist the access token by recognizing the specific user by a cookie on a web browser that comprises a user ID; to find an access token associated with the user ID; to use the associated access token to access the third-party resource server at a later time for a different resource; to receive the different resource from the third-party resource server; and to return the different resource to the in-browser application.

20. The non-transitory computer-readable medium of claim 13 , wherein the request for the access token from the authorization server is executed without involvement of the in-browser application.

21. A system comprising:

a computer processor and a computer storage device, wherein the computer processor and the computer storage device are configured to:

in an application server:

receive a request from an in-browser application for an authorization code for a specific user, wherein the in-browser application comprises a Java-Script-based application that runs only inside of a browser;

create a session that re-directs the in-browser application to an authorization server;

receive the authorization code from the authorization server by way of the in-browser application;

request an access token from the authorization server;

receive the access token from the authorization server;

managing a secure storage protocol for the access token on the application server;

receive a request from the in-browser application for a resource;

use the access token to request the resource from a third-party resource server; and

return the resource to the in-browser application;

wherein the in-browser application communicates with a plurality of end point nodes on the application server.