title: Secure OAuth in Javascript
body: <p>I have an api which uses OAuth 1.0a to authenticate applications using it. It's replacing an old api which used a number of custom built and hodge-podge calls which are being deprecated.</p>
  
  <p>It's well known that OAuth 1.0a is not secure in (client-side) Javascript since it relies on the consumer secret being kept secret. Which is not possible since the source is always viewable.</p>
  
  <p>We have browser extensions for Chrome, Firefox, IE and Safari which need to use this api in the future. These extensions are all written largely or entirely in Javascript, and hence the problem of security.</p>
  
  <p>These extensions are in-house and so can have custom authentication methods to get their access tokens.</p>
  
  <p>What I'm planning on implementing is the following:</p>
  
  <ul>
  <li>The user logs into the website in the browser.</li>
  <li>The website issues them a cookie with a session key.</li>
  <li>Our extension then takes that cookie and passes it to the api.</li>
  <li>The api validates that it is a valid &amp; active session and issues the extension its access tokens.</li>
  <li>These tokens last for a maximum of one hour before they expire.</li>
  <li>There will also be lower rate limits on the javascript issued cookies.</li>
  </ul>
  
  <p>It operates under the following assumptions:</p>
  
  <ul>
  <li>If another application has access to your cookies, then they can impersonate you on the website anyway, so access to the api is no different.</li>
  <li>All authentication methods still go through our control.</li>
  <li>Regular expiry of tokens means that if they are compromised then there is a limited time for exploitation.</li>
  </ul>
  
  <p>My question is, is this a secure method of restricting access to the api?
  Are there any better ones?</p>
  
  <p><strong>A couple of notes.</strong>
  I know for a fact that chrome extensions can ask for permission to access your cookies for a given site. I believe firefox extensions can do so too.</p>
  
  <p>Obviously we don't want our cookies accessible via javascript on any page otherwise we'd expose ourselves to XSS attacks, so they need to only be accessible via extensions.</p>