oauth token sharing multiple applications

Question

My applications structure is like below -

https://democompany.com/
https://democompany.com/app1
https://democompany.com/api

User logs in at main website url https://democompany.com/logon.aspx which is a asp.net webforms application.

app1 application is an angularjs application which uses /api app. api is webapi2 application which uses oauth token for authentication. I would like have the user login only once at democompany.com/logon.aspx and pass the oauth token to angularjs application.

Is there a recommended way to pass oauth token from one application to another.

Answer 1

As long as your applications use one subdomain, you can use client side window.localStorage for that purposes.

// to set token in storage    
window.localStorage.setItem('access_token', access_token);
// to get token from storage
access_token = window.localStorage.getItem('access_token');

So you will have access to that storage from every page with some javascript code. For example with combination of angular + web.api you can setup token for all your requests in $http service:

$http.defaults.headers.common['Authorization'] = "Bearer " + token;

Also you can use interceptor to setup token if you want to have more control of your code.