To avoid systematically going through a reverse proxy whose role is to link the session (session ID) to access_token (pic 1), I would like to push the access_token obtained by OAuth2 Authorization code Grant Flow to the browser and keep it in the cookie. The browser can call the gateway (OAuth2 protection) directly (pic 2).

I'd like to know the risks and understand how a reverse proxy can protect me.

Pic 1 : enter image description here

Pic 2 : enter image description here

Thanks for your help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.