javascript - Moving from Session-based token mechanism to OAuth 2.0 mechanism -

The owner of a Play Framework application to provide a set of restore APIs for acting as a backend server I am I have an Angular JS application that calls API via backend-server via AJAX.

Currently, I use a solution based on the session-token mechanism.
This means that when a user logs successfully, a cookie is recovered on the client side with an authentication token. On each request, the cookie value provided by the client request (Eth Token) is extracted on the server and if valid, the request is made.

Now I want to use OAuth 2.0. Are the reasons :

• This is a great standard way of securing the API, to avoid using the datastore (memkachad), to keep the token on the server side, as I currently make available I am here.
• I want to provide some clients_centers and nons better secure than a single cookie so that some avoid recurrence attacks ...
• I restrict the quantity of customers I want, as far as the Public Rest API I provide, that is, the API allows anonymous calls, for example to list the list of items.

  The issue is that I do not want to include the third party because I have all the preserved resources myself
  I was understood how to protect the internal REST API with OAuth 2.0, which normally executes 2-leg instead of 3-step.

  However, I do not know how the client credentials flow can authenticate a specific user when calling a REST API that requires user authentication. is.

  In fact, the flow of client credentials is global client_id , client_secret key (global for the app, therefore in my case is based on my javascript) app ), And therefore specific users and administrators are not specific enough to target their specific rights.

  Any help would be great.

  It seems that you should use "resource owner" password credentials grant "() it dead Is simple - put in the Client ID / Privacy Authority header and put the username / password in the query variable. Here is an example from RFC:

    POST / token HTTP / 1.1 host: server Example.com Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW Content Type: Application / x-www-form-urlencoded grant_type = password and user no M = johndoe & password = a3ddj3w   
   The server side can check for both validity of the customer (both as well as users) just remember that client credentials It is impossible to protect because it will be embedded in your (downloadable) Javascript code. The username / password is entered directly by the end user.