Usage: Browser App to Campus API Gateway Requirements

Project Title	Campus API Gateway
Target Release
Epic
Document Status	DRAFT
Document Owner
Document Sign-Off
Subject Matter Expert(s)
Technical Expert(s)

Background & Business Value

This is the same use case as Usage: Application to Campus API Gateway Requirements, except that the Browser (instead of the Web Application Server) will be making calls directly to the API Gateway. As such, this means that the Web App Authentication/Access Token will need to be available within the browser. This is a security risk as browsers are insecure endpoints. The Campus API Gateway team would not suggest using this scenario and would alternatively suggest using the scenario described in Usage: Application to Campus API Gateway Requirements. However, if the risk is acceptable to your application, then ...

Real World Scenario: A browser application needs to retrieve Registrar class level code translations in order to display it on the screen. The web application will need to call through the API Gateway to the Lookupsr service. The Lookups service does not need to know what client is calling it; it only needs to trust that the API Gateway verified the client has permissions to make the call.

Goals

Same as Usage: Application to Campus API Gateway Requirements

Out of Scope

Same as Usage: Application to Campus API Gateway Requirements

Assumptions

Same as Usage: Application to Campus API Gateway Requirements

Requirements

Must meet all requirements of Usage: Application to Campus API Gateway Requirements

Ticket(s)	Title	User Story	Priority	Notes
	Access Tokens used in Browser	As an Application Developer, the authentication/access tokens generated by the authentication system will need to be used from the browser.	MUST HAVE	Once authentication is completed using the scenario described in Usage: Application to Campus API Gateway Requirements, the Authentication/Access Tokens can be sent to the browser for usage.

User Interaction, Design & Architecture

Please refer to Usage: Application to Campus API Gateway Requirements for a comparison with the standard use case.

Service Architecture for OAuth Token (PowerPoint)

Sequence Diagram for OAuth Token (WebSequenceDiagrams Link)

Service Architecture for OAuth JWT (PowerPoint)

Sequence Diagram for OAuth JWT (WebSequenceDiagrams Link)

Examples and References

Same as Usage: Application to Campus API Gateway Requirements

Questions

Below is a list of questions to be addressed as a result of this requirements document:

Question	Outcome	Decision Date