jessym / tutorial-social-logins Goto Github PK

Hi, just read your article https://www.jessym.com/articles/stateless-oauth2-social-logins-with-spring-boot, thank you for putting together a very detailed article! I found it very informative and relevant. (I always find it confusing for oauth-client to be stateful where SSO is usually stateless).

And I've got some questions regarding some design decisions and I wonder if you could provide your insights.

First, I'd like to share my understanding of Single Sign-On, for a typical website with a separated backend/frontend, where the frontend calls the backend's REST API to do various things, and authentication is done via bearer token (JWT). So there is no typical session/cookies involved.

Is the reality expected? Is there something missing/wrong in my understanding?

I am particularly confused by the usage of session/cookie in step 3, we already retrieved access token from step 2, why no simply use it for future authorization with backend APIs.