I had the opportunity to test IIIF Authentication API 2.0, so here are my notes.
https://iiif.io/api/auth/2.0/
I created the following demo site.
https://iiif-auth-nextjs.vercel.app/ja
The repository is as follows.
https://github.com/nakamura196/iiif-auth-nextjs
Below is an AI-generated explanation. Note that I was unable to get it working properly with Mirador, which remains a future task.
This article provides a detailed explanation of the IIIF Authentication API 2.0 authentication flow at the level of actual HTTP requests/responses. We will trace what requests are sent and what responses are returned at each step.
Architecture Overview# ┌ │ │ └ ─ ─ ─ ─ ─ ( ─ ─ C B ─ ─ l r ─ ─ i o ─ ─ e w ─ ─ n s ─ ─ t e ─ ─ r ─ ─ ) ─ ─ ─ ─ ─ ┐ │ │ ┘ ─ ◀ ─ ─ ─ ─ ─ ─ ▶ ─ ┌ │ │ └ ─ ─ ─ I ─ ─ I ─ ─ I ─ ─ F ─ ─ ─ ─ S ─ ─ e ─ ─ r ─ ─ v ─ ─ e ─ ─ r ─ ─ ─ ┐ │ │ ┘ ─ ◀ ─ ─ ─ ─ ─ ─ ▶ ─ ┌ │ │ └ ─ A ─ ─ u ─ ─ t ─ ─ h ─ ─ ─ ─ S ─ ─ e ─ ─ r ─ ─ v ─ ─ i ─ ─ c ─ ─ e ─ ─ ─ ┐ │ │ ┘
Authentication Flow Details# Request:
G H A E o c T s c t e / : p a t p l : i c a i a p i l p i h l f i s c i t a m : t a 3 i g 0 o e 0 n / 1 / s j a s m o p n l e / i n f o . j s o n H T T P / 1 . 1 Processing Flow (Server-side):
e } x p c l i } c i } a o e f o f p r n t t n r } p t 1 s 2 ( o 3 s 4 ( e , / . t t . ! k . t . ! t e s } a a o t e i u r e ] { p s C a k A o n T i R s r r r " " " i y h u e l k o s e V n o v @ i t s / n e t n s e = k V t a r i c d y t i c c h o n e a u l N : c o " p a i k H = ) r n l r i e e n : e t i f e c e i n d x ' : t " u f u A a a h { q v d ) t A e ` : s / n u d u e u e 4 R u [ x $ : i c t e t c e r = 0 { e t { t { " m t h r h k s i 1 s h " r A 4 a i o H t f t p e : e u 0 g o r = e q . i o i o n q t 1 e n i a u n c k f n t " u h / z r d e e a e s i h e P } [ G a e e r x t n u e c t s r ) i E t q r y t i n . a t t o ; d T i u ? U o ? a j t p . b ] ( o e . p r n u s i : n e / r n s r a l a t o o / e S i e t e r . w h n n / x e n q h . p a s a e ( i t r f u e h l m e i n { r i U v o e a e a e a t t e i r i . s d a c t r i q f l c j t e d e e c v c u . . e s : r e ( r h e a i i o 2 o r ' s P r t r o r " n N s B a i e e / i / e . e ( r f d d a g r x g a f a y ' p i o t e r a m T , i n u R t e l s o / } t e ( r l . k a / e q ' b g e u a . u a ' a e n t p t e u , c t ( h i s s t k ( t / / t h ) ' o 2 i ) o t k / i r ) o e c i { i ; k n o f z e ) n / a n t p t ' : e r i ) x o o n t b n u . e ' l j ` ) l s , ; ; o ' n ; " , Response:
H C A { } T o c T n c " " } P t e e s ] / e s r e " " " 1 n s r r @ i t . t - o v c d y 1 - C r i o " p T o " c n : e 4 y n : e t " 0 p t " e " : 1 e r " : x h : o A t t " U l u [ " t A n a - t { : p u a p A h : t u p l e " / h t l l n h / P h i o t t l r o c w i t o o r a - c p c b i t O a : a e z i r t / l S e o i i / h e d n g o i o r / i n i s v j n i t i s : r f : c o e . 3 e n q i 0 2 u o 0 " i / 1 r a / e p a d i p " / i , a / u i t i h i / f 2 p c r o o n b t e e " x , t . j s o n " , Step 2: Request to Probe Service# The client obtains the AuthProbeService2 URL from the 401 response and checks the authentication status.
Request:
G H A E o c T s c t e / : p a t p l : i c a i a p i l p i h l f i s c p t a r : t o 3 i b 0 o e 0 n 1 / H j T s T o P n / 1 . 1 Processing Flow (Server-side):
e } x p c c i } r } a o o o f e , p r n n c i } t " " " " } p t s s ( o f I u @ t s s ] { / t t t n r } f r c y t e " " " " " " } a a o s ( e ) n o p a r @ i t p l s ] s p s a t k t p t " " " " } ; u n e t v c d y r a e " " " t i y u o e a I u @ t s l n N t " u i o " p o b r @ i t a / n t k n p y f r c y t o " " a e e : s c n : e f e v c d y t i c h e ) a l n o p a c i t u x x " e t " i l i o " p u i H n y o a n e t a d y t t t " : " e ` : l " c n : e s i f e { l a u N t " u t " p h R " A : x $ e : e t " : f u a = o d t e e : s i : e e e : u 4 t { " " " e ` : / n d a ) h x x " o " n s t 0 [ " r A : " : x $ 4 p c e a d e t t " : n ` : t p " h 1 { : e u L t { " 0 r t r u { n R " A " $ i o h P , q t " o [ " r A 1 o i t = t e : u 2 : { " c n t r " u h a g { : e u b o = h i s t 0 r I a s t o h e A c i q t } e n H a c p " h 0 { e m t e p b t s c t n " u h ) / r e w a o h P , q a e . : e t t c i h e A ; r G e a a t n t r u g d j / R p . e v t t s c o E q d i e s t o e e s e : n s e o t t c u T u e t d e p b s " i s / e s " p . e t ( e r . : e t n i u / x S , I : n s e r s ? v j / R . ( i l i t e I / e s . e t . e s e n { f t i U r I / x T t q . r r i s e . 2 i r v F i t o s u h e i n i u x i " f l i i U k e e p f ( i l t o , . . c A i r e s a l y { f t U / i o e u f l n t d a T . 2 r a o r 2 t . . S : e c o i " l p / i " h i o e r e k o , . i a g , o r r N s ( e / o / p i D / i v e . ' n a r a i n e a g i x g B ( p i u / } m p i c t e e t i g t a / o i n e R t a o / i h u a " / } 2 e ( r k a n / t p , a / " q ' e e u } 2 h i u a u a r n t / / / / t p e u ) h a c 2 i h i s t ' ; / p o / i / / t h , 2 i n c i 2 i ) o / / t o f / i r c i e n / c i { i o i x t a o f z ) n i t e c n / a ; t f . x c t t t e / j t e e o i x i s . s x k o t m o j s t e n . a n s ` . n ' j g " o , j ` ) s e , n s , ; o / " o n s , n " a " , m , p l e / i n f o . j s o n ` , Response (Unauthenticated):
{ } " " " " } @ t s s ] c y t e " " " " " " } o p a r @ i t p l s ] n e t v c d y r a e " " " t " u i o " p o b r @ i t e : s c n : e f e v c d y x " e t " i l i o " p t " : " e " : l " c n : e " A : x h e : e t " : u 4 t t " " " e " : t 0 [ " t A : " : x h " h 1 { : p u L t t " h P , : t " o [ " t A t r " / h a g { : p u t o h / A c i : t p b t l c t n " / h : e t o c i h / A / R p c e v t t l c / e : a s e o t o c i s / l s " p c e i u / h S , I : a s i l i o e I / l s f t i s r I / h T . 2 i t v F i o o i " f : i i s k o , . 3 c A i t e / i 0 e u f : n a o 0 2 t . 3 S p / 1 " h i 0 e i a / , o 0 r / p a D / 1 a i p e a / i u / i m p a c t a / o i p e h u i " / i 2 / t i , a / " 2 h i u i / / f t i c 2 h i o a / f n c c 2 t o c t e n e c o x t s o k t e s n e . x " t n j t , e " s . x , o j t n s . " o j , n s " o , n " , Step 3: Starting the Authentication Window# The client obtains the AuthAccessTokenService2 URL from the Probe Service response and opens a popup window.
Client-side Processing:
c c c c t t c ) o o o o o o o ; n n n n k k n t ' ' G s s G s B s e e O s o i w e t t e t u t n n p t k i i t n i U U e e i d a t e m l t r r n a n f t a u o r e d o l l u U - h u t k a s k . . p t r a = t h e t s t e s s o h l u 6 h S n e a o n e e p W . t 0 e e S g k U a a u i t h 0 n r e m e e r r r p n o ' , t v r e I n l c c d S , h i i v s d h h w o t e c c i s s = P P i w r i a e c a = e a a n i g t e g r n r r d = n h i = e c v e a a o g t o = r i w m m w w ( = n p I y c s s i ) 6 r a D p e U . . n , 0 s o u t R s s d 0 e b t ( o U L e e o ' r e h f . R ( t t w v R S o r L t ( ( . i e e r a o ' ' o c s r n k m o p e u v r d e e r e l i e o n s i n i t c s m S s g ( n . e p U e a i f s . o U r g n o e s n I v e ' r r e s D i I , m v r e ( c d a i v ) e ' w t c i i ; . , i i e c d i n o [ e e d m d n 0 [ n ) e o ] 0 t ; s w ; ] i s . ; f a l i g o c e c a I a t d t i ) i o ; o n n ) . o r i g i n ) ; Generated URL:
h t t p : / / l o c a l h o s t : 3 0 0 1 / a p i / i i i f / t o k e n ? m e s s a g e I d = 6 0 f 4 4 2 0 d - 5 2 c 1 - 4 8 a e - a 2 4 f - c 3 b b 9 4 8 f a 0 d c & o r i g i n = h t t p : / / l o c a l h o s t : 3 0 0 1
Step 4: Token Service Redirect Processing# Request:
G H E o T s t / : a p l i c i a i l i h f s t t o : k 3 e 0 n 0 ? 1 m e s s a g e I d = 6 0 f 4 4 2 0 d - 5 2 c 1 - 4 8 a e - a 2 4 f - c 3 b b 9 4 8 f a 0 d c & o r i g i n = h t t p : / / l o c a l h o s t : 3 0 0 1 H T T P / 1 . 1 Processing Flow (Server-side):
G H A E o c T s c t e / : p a t p l : i c a i a p i l p i h l f i s c i t a m : t a 3 i g 0 o e 0 n / 1 / s j a s m o p n l e / i n f o . j s o n H T T P / 1 . 1 0
Response:
G H A E o c T s c t e / : p a t p l : i c a i a p i l p i h l f i s c i t a m : t a 3 i g 0 o e 0 n / 1 / s j a s m o p n l e / i n f o . j s o n H T T P / 1 . 1 1
Step 5: Authentication on the Login Page# Login Form Submission:
G H A E o c T s c t e / : p a t p l : i c a i a p i l p i h l f i s c i t a m : t a 3 i g 0 o e 0 n / 1 / s j a s m o p n l e / i n f o . j s o n H T T P / 1 . 1 2
Processing Flow (Server-side):
G H A E o c T s c t e / : p a t p l : i c a i a p i l p i h l f i s c i t a m : t a 3 i g 0 o e 0 n / 1 / s j a s m o p n l e / i n f o . j s o n H T T P / 1 . 1 3
JWT Generation Details:
G H A E o c T s c t e / : p a t p l : i c a i a p i l p i h l f i s c i t a m : t a 3 i g 0 o e 0 n / 1 / s j a s m o p n l e / i n f o . j s o n H T T P / 1 . 1 4
Response:
G H A E o c T s c t e / : p a t p l : i c a i a p i l p i h l f i s c i t a m : t a 3 i g 0 o e 0 n / 1 / s j a s m o p n l e / i n f o . j s o n H T T P / 1 . 1 5
Step 6: Token Delivery (postMessage)# After successful login, the client receives the token and sends it to the original window via the Token Service.
Client-side (auth/page.tsx):
G H A E o c T s c t e / : p a t p l : i c a i a p i l p i h l f i s c i t a m : t a 3 i g 0 o e 0 n / 1 / s j a s m o p n l e / i n f o . j s o n H T T P / 1 . 1 6
Step 7: Token Reception in the Original Window# Client-side (Main Window):
G H A E o c T s c t e / : p a t p l : i c a i a p i l p i h l f i s c i t a m : t a 3 i g 0 o e 0 n / 1 / s j a s m o p n l e / i n f o . j s o n H T T P / 1 . 1 7
Step 8: Authenticated Image Request# Request:
G H A E o c T s c t e / : p a t p l : i c a i a p i l p i h l f i s c i t a m : t a 3 i g 0 o e 0 n / 1 / s j a s m o p n l e / i n f o . j s o n H T T P / 1 . 1 8
Processing Flow (Server-side):
G H A E o c T s c t e / : p a t p l : i c a i a p i l p i h l f i s c i t a m : t a 3 i g 0 o e 0 n / 1 / s j a s m o p n l e / i n f o . j s o n H T T P / 1 . 1 9
Response:
e } x p c l i } c i } a o e f o f p r n t t n r } p t 1 s 2 ( o 3 s 4 ( e , / . t t . ! k . t . ! t e s } a a o t e i u r e ] { p s C a k A o n T i R s r r r " " " i y h u e l k o s e V n o v @ i t s / n e t n s e = k V t a r i c d y t i c c h o n e a u l N : c o " p a i k H = ) r n l r i e e n : e t i f e c e i n d x ' : t " u f u A a a h { q v d ) t A e ` : s / n u d u e u e 4 R u [ x $ : i c t e t c e r = 0 { e t { t { " m t h r h k s i 1 s h " r A 4 a i o H t f t p e : e u 0 g o r = e q . i o i o n q t 1 e n i a u n c k f n t " u h / z r d e e a e s i h e P } [ G a e e r x t n u e c t s r ) i E t q r y t i n . a t t o ; d T i u ? U o ? a j t p . b ] ( o e . p r n u s i : n e / r n s r a l a t o o / e S i e t e r . w h n n / x e n q h . p a s a e ( i t r f u e h l m e i n { r i U v o e a e a e a t t e i r i . s d a c t r i q f l c j t e d e e c v c u . . e s : r e ( r h e a i i o 2 o r ' s P r t r o r " n N s B a i e e / i / e . e ( r f d d a g r x g a f a y ' p i o t e r a m T , i n u R t e l s o / } t e ( r l . k a / e q ' b g e u a . u a ' a e n t p t e u , c t ( h i s s t k ( t / / t h ) ' o 2 i ) o t k / i r ) o e c i { i ; k n o f z e ) n / a n t p t ' : e r i ) x o o n t b n u . e ' l j ` ) l s , ; ; o ' n ; " , 0
Token Persistence and Synchronization# Persistence via localStorage# e } x p c l i } c i } a o e f o f p r n t t n r } p t 1 s 2 ( o 3 s 4 ( e , / . t t . ! k . t . ! t e s } a a o t e i u r e ] { p s C a k A o n T i R s r r r " " " i y h u e l k o s e V n o v @ i t s / n e t n s e = k V t a r i c d y t i c c h o n e a u l N : c o " p a i k H = ) r n l r i e e n : e t i f e c e i n d x ' : t " u f u A a a h { q v d ) t A e ` : s / n u d u e u e 4 R u [ x $ : i c t e t c e r = 0 { e t { t { " m t h r h k s i 1 s h " r A 4 a i o H t f t p e : e u 0 g o r = e q . i o i o n q t 1 e n i a u n c k f n t " u h / z r d e e a e s i h e P } [ G a e e r x t n u e c t s r ) i E t q r y t i n . a t t o ; d T i u ? U o ? a j t p . b ] ( o e . p r n u s i : n e / r n s r a l a t o o / e S i e t e r . w h n n / x e n q h . p a s a e ( i t r f u e h l m e i n { r i U v o e a e a e a t t e i r i . s d a c t r i q f l c j t e d e e c v c u . . e s : r e ( r h e a i i o 2 o r ' s P r t r o r " n N s B a i e e / i / e . e ( r f d d a g r x g a f a y ' p i o t e r a m T , i n u R t e l s o / } t e ( r l . k a / e q ' b g e u a . u a ' a e n t p t e u , c t ( h i s s t k ( t / / t h ) ' o 2 i ) o t k / i r ) o e c i { i ; k n o f z e ) n / a n t p t ' : e r i ) x o o n t b n u . e ' l j ` ) l s , ; ; o ' n ; " , 1
Synchronization Between Tabs# e } x p c l i } c i } a o e f o f p r n t t n r } p t 1 s 2 ( o 3 s 4 ( e , / . t t . ! k . t . ! t e s } a a o t e i u r e ] { p s C a k A o n T i R s r r r " " " i y h u e l k o s e V n o v @ i t s / n e t n s e = k V t a r i c d y t i c c h o n e a u l N : c o " p a i k H = ) r n l r i e e n : e t i f e c e i n d x ' : t " u f u A a a h { q v d ) t A e ` : s / n u d u e u e 4 R u [ x $ : i c t e t c e r = 0 { e t { t { " m t h r h k s i 1 s h " r A 4 a i o H t f t p e : e u 0 g o r = e q . i o i o n q t 1 e n i a u n c k f n t " u h / z r d e e a e s i h e P } [ G a e e r x t n u e c t s r ) i E t q r y t i n . a t t o ; d T i u ? U o ? a j t p . b ] ( o e . p r n u s i : n e / r n s r a l a t o o / e S i e t e r . w h n n / x e n q h . p a s a e ( i t r f u e h l m e i n { r i U v o e a e a e a t t e i r i . s d a c t r i q f l c j t e d e e c v c u . . e s : r e ( r h e a i i o 2 o r ' s P r t r o r " n N s B a i e e / i / e . e ( r f d d a g r x g a f a y ' p i o t e r a m T , i n u R t e l s o / } t e ( r l . k a / e q ' b g e u a . u a ' a e n t p t e u , c t ( h i s s t k ( t / / t h ) ' o 2 i ) o t k / i r ) o e c i { i ; k n o f z e ) n / a n t p t ' : e r i ) x o o n t b n u . e ' l j ` ) l s , ; ; o ' n ; " , 2
CORS Configuration# Image API Endpoint# e } x p c l i } c i } a o e f o f p r n t t n r } p t 1 s 2 ( o 3 s 4 ( e , / . t t . ! k . t . ! t e s } a a o t e i u r e ] { p s C a k A o n T i R s r r r " " " i y h u e l k o s e V n o v @ i t s / n e t n s e = k V t a r i c d y t i c c h o n e a u l N : c o " p a i k H = ) r n l r i e e n : e t i f e c e i n d x ' : t " u f u A a a h { q v d ) t A e ` : s / n u d u e u e 4 R u [ x $ : i c t e t c e r = 0 { e t { t { " m t h r h k s i 1 s h " r A 4 a i o H t f t p e : e u 0 g o r = e q . i o i o n q t 1 e n i a u n c k f n t " u h / z r d e e a e s i h e P } [ G a e e r x t n u e c t s r ) i E t q r y t i n . a t t o ; d T i u ? U o ? a j t p . b ] ( o e . p r n u s i : n e / r n s r a l a t o o / e S i e t e r . w h n n / x e n q h . p a s a e ( i t r f u e h l m e i n { r i U v o e a e a e a t t e i r i . s d a c t r i q f l c j t e d e e c v c u . . e s : r e ( r h e a i i o 2 o r ' s P r t r o r " n N s B a i e e / i / e . e ( r f d d a g r x g a f a y ' p i o t e r a m T , i n u R t e l s o / } t e ( r l . k a / e q ' b g e u a . u a ' a e n t p t e u , c t ( h i s s t k ( t / / t h ) ' o 2 i ) o t k / i r ) o e c i { i ; k n o f z e ) n / a n t p t ' : e r i ) x o o n t b n u . e ' l j ` ) l s , ; ; o ' n ; " , 3
Probe/Access Service# e } x p c l i } c i } a o e f o f p r n t t n r } p t 1 s 2 ( o 3 s 4 ( e , / . t t . ! k . t . ! t e s } a a o t e i u r e ] { p s C a k A o n T i R s r r r " " " i y h u e l k o s e V n o v @ i t s / n e t n s e = k V t a r i c d y t i c c h o n e a u l N : c o " p a i k H = ) r n l r i e e n : e t i f e c e i n d x ' : t " u f u A a a h { q v d ) t A e ` : s / n u d u e u e 4 R u [ x $ : i c t e t c e r = 0 { e t { t { " m t h r h k s i 1 s h " r A 4 a i o H t f t p e : e u 0 g o r = e q . i o i o n q t 1 e n i a u n c k f n t " u h / z r d e e a e s i h e P } [ G a e e r x t n u e c t s r ) i E t q r y t i n . a t t o ; d T i u ? U o ? a j t p . b ] ( o e . p r n u s i : n e / r n s r a l a t o o / e S i e t e r . w h n n / x e n q h . p a s a e ( i t r f u e h l m e i n { r i U v o e a e a e a t t e i r i . s d a c t r i q f l c j t e d e e c v c u . . e s : r e ( r h e a i i o 2 o r ' s P r t r o r " n N s B a i e e / i / e . e ( r f d d a g r x g a f a y ' p i o t e r a m T , i n u R t e l s o / } t e ( r l . k a / e q ' b g e u a . u a ' a e n t p t e u , c t ( h i s s t k ( t / / t h ) ' o 2 i ) o t k / i r ) o e c i { i ; k n o f z e ) n / a n t p t ' : e r i ) x o o n t b n u . e ' l j ` ) l s , ; ; o ' n ; " , 4
Error Handling# Token Expiration# e } x p c l i } c i } a o e f o f p r n t t n r } p t 1 s 2 ( o 3 s 4 ( e , / . t t . ! k . t . ! t e s } a a o t e i u r e ] { p s C a k A o n T i R s r r r " " " i y h u e l k o s e V n o v @ i t s / n e t n s e = k V t a r i c d y t i c c h o n e a u l N : c o " p a i k H = ) r n l r i e e n : e t i f e c e i n d x ' : t " u f u A a a h { q v d ) t A e ` : s / n u d u e u e 4 R u [ x $ : i c t e t c e r = 0 { e t { t { " m t h r h k s i 1 s h " r A 4 a i o H t f t p e : e u 0 g o r = e q . i o i o n q t 1 e n i a u n c k f n t " u h / z r d e e a e s i h e P } [ G a e e r x t n u e c t s r ) i E t q r y t i n . a t t o ; d T i u ? U o ? a j t p . b ] ( o e . p r n u s i : n e / r n s r a l a t o o / e S i e t e r . w h n n / x e n q h . p a s a e ( i t r f u e h l m e i n { r i U v o e a e a e a t t e i r i . s d a c t r i q f l c j t e d e e c v c u . . e s : r e ( r h e a i i o 2 o r ' s P r t r o r " n N s B a i e e / i / e . e ( r f d d a g r x g a f a y ' p i o t e r a m T , i n u R t e l s o / } t e ( r l . k a / e q ' b g e u a . u a ' a e n t p t e u , c t ( h i s s t k ( t / / t h ) ' o 2 i ) o t k / i r ) o e c i { i ; k n o f z e ) n / a n t p t ' : e r i ) x o o n t b n u . e ' l j ` ) l s , ; ; o ' n ; " , 5
Handling Authentication Errors# e } x p c l i } c i } a o e f o f p r n t t n r } p t 1 s 2 ( o 3 s 4 ( e , / . t t . ! k . t . ! t e s } a a o t e i u r e ] { p s C a k A o n T i R s r r r " " " i y h u e l k o s e V n o v @ i t s / n e t n s e = k V t a r i c d y t i c c h o n e a u l N : c o " p a i k H = ) r n l r i e e n : e t i f e c e i n d x ' : t " u f u A a a h { q v d ) t A e ` : s / n u d u e u e 4 R u [ x $ : i c t e t c e r = 0 { e t { t { " m t h r h k s i 1 s h " r A 4 a i o H t f t p e : e u 0 g o r = e q . i o i o n q t 1 e n i a u n c k f n t " u h / z r d e e a e s i h e P } [ G a e e r x t n u e c t s r ) i E t q r y t i n . a t t o ; d T i u ? U o ? a j t p . b ] ( o e . p r n u s i : n e / r n s r a l a t o o / e S i e t e r . w h n n / x e n q h . p a s a e ( i t r f u e h l m e i n { r i U v o e a e a e a t t e i r i . s d a c t r i q f l c j t e d e e c v c u . . e s : r e ( r h e a i i o 2 o r ' s P r t r o r " n N s B a i e e / i / e . e ( r f d d a g r x g a f a y ' p i o t e r a m T , i n u R t e l s o / } t e ( r l . k a / e q ' b g e u a . u a ' a e n t p t e u , c t ( h i s s t k ( t / / t h ) ' o 2 i ) o t k / i r ) o e c i { i ; k n o f z e ) n / a n t p t ' : e r i ) x o o n t b n u . e ' l j ` ) l s , ; ; o ' n ; " , 6
Security Considerations# 1. Token Signature Verification# e } x p c l i } c i } a o e f o f p r n t t n r } p t 1 s 2 ( o 3 s 4 ( e , / . t t . ! k . t . ! t e s } a a o t e i u r e ] { p s C a k A o n T i R s r r r " " " i y h u e l k o s e V n o v @ i t s / n e t n s e = k V t a r i c d y t i c c h o n e a u l N : c o " p a i k H = ) r n l r i e e n : e t i f e c e i n d x ' : t " u f u A a a h { q v d ) t A e ` : s / n u d u e u e 4 R u [ x $ : i c t e t c e r = 0 { e t { t { " m t h r h k s i 1 s h " r A 4 a i o H t f t p e : e u 0 g o r = e q . i o i o n q t 1 e n i a u n c k f n t " u h / z r d e e a e s i h e P } [ G a e e r x t n u e c t s r ) i E t q r y t i n . a t t o ; d T i u ? U o ? a j t p . b ] ( o e . p r n u s i : n e / r n s r a l a t o o / e S i e t e r . w h n n / x e n q h . p a s a e ( i t r f u e h l m e i n { r i U v o e a e a e a t t e i r i . s d a c t r i q f l c j t e d e e c v c u . . e s : r e ( r h e a i i o 2 o r ' s P r t r o r " n N s B a i e e / i / e . e ( r f d d a g r x g a f a y ' p i o t e r a m T , i n u R t e l s o / } t e ( r l . k a / e q ' b g e u a . u a ' a e n t p t e u , c t ( h i s s t k ( t / / t h ) ' o 2 i ) o t k / i r ) o e c i { i ; k n o f z e ) n / a n t p t ' : e r i ) x o o n t b n u . e ' l j ` ) l s , ; ; o ' n ; " , 7
2. Using HTTPS (Production Environment)# e } x p c l i } c i } a o e f o f p r n t t n r } p t 1 s 2 ( o 3 s 4 ( e , / . t t . ! k . t . ! t e s } a a o t e i u r e ] { p s C a k A o n T i R s r r r " " " i y h u e l k o s e V n o v @ i t s / n e t n s e = k V t a r i c d y t i c c h o n e a u l N : c o " p a i k H = ) r n l r i e e n : e t i f e c e i n d x ' : t " u f u A a a h { q v d ) t A e ` : s / n u d u e u e 4 R u [ x $ : i c t e t c e r = 0 { e t { t { " m t h r h k s i 1 s h " r A 4 a i o H t f t p e : e u 0 g o r = e q . i o i o n q t 1 e n i a u n c k f n t " u h / z r d e e a e s i h e P } [ G a e e r x t n u e c t s r ) i E t q r y t i n . a t t o ; d T i u ? U o ? a j t p . b ] ( o e . p r n u s i : n e / r n s r a l a t o o / e S i e t e r . w h n n / x e n q h . p a s a e ( i t r f u e h l m e i n { r i U v o e a e a e a t t e i r i . s d a c t r i q f l c j t e d e e c v c u . . e s : r e ( r h e a i i o 2 o r ' s P r t r o r " n N s B a i e e / i / e . e ( r f d d a g r x g a f a y ' p i o t e r a m T , i n u R t e l s o / } t e ( r l . k a / e q ' b g e u a . u a ' a e n t p t e u , c t ( h i s s t k ( t / / t h ) ' o 2 i ) o t k / i r ) o e c i { i ; k n o f z e ) n / a n t p t ' : e r i ) x o o n t b n u . e ' l j ` ) l s , ; ; o ' n ; " , 8
3. Origin Verification# e } x p c l i } c i } a o e f o f p r n t t n r } p t 1 s 2 ( o 3 s 4 ( e , / . t t . ! k . t . ! t e s } a a o t e i u r e ] { p s C a k A o n T i R s r r r " " " i y h u e l k o s e V n o v @ i t s / n e t n s e = k V t a r i c d y t i c c h o n e a u l N : c o " p a i k H = ) r n l r i e e n : e t i f e c e i n d x ' : t " u f u A a a h { q v d ) t A e ` : s / n u d u e u e 4 R u [ x $ : i c t e t c e r = 0 { e t { t { " m t h r h k s i 1 s h " r A 4 a i o H t f t p e : e u 0 g o r = e q . i o i o n q t 1 e n i a u n c k f n t " u h / z r d e e a e s i h e P } [ G a e e r x t n u e c t s r ) i E t q r y t i n . a t t o ; d T i u ? U o ? a j t p . b ] ( o e . p r n u s i : n e / r n s r a l a t o o / e S i e t e r . w h n n / x e n q h . p a s a e ( i t r f u e h l m e i n { r i U v o e a e a e a t t e i r i . s d a c t r i q f l c j t e d e e c v c u . . e s : r e ( r h e a i i o 2 o r ' s P r t r o r " n N s B a i e e / i / e . e ( r f d d a g r x g a f a y ' p i o t e r a m T , i n u R t e l s o / } t e ( r l . k a / e q ' b g e u a . u a ' a e n t p t e u , c t ( h i s s t k ( t / / t h ) ' o 2 i ) o t k / i r ) o e c i { i ; k n o f z e ) n / a n t p t ' : e r i ) x o o n t b n u . e ' l j ` ) l s , ; ; o ' n ; " , 9
1. Token Caching# H C A { } T o c T n c " " } P t e e s ] / e s r e " " " 1 n s r r @ i t . t - o v c d y 1 - C r i o " p T o " c n : e 4 y n : e t " 0 p t " e " : 1 e r " : x h : o A t t " U l u [ " t A n a - t { : p u a p A h : t u p l e " / h t l l n h / P h i o t t l r o c w i t o o r a - c p c b i t O a : a e z i r t / l S e o i i / h e d n g o i o r / i n i s v j n i t i s : r f : c o e . 3 e n q i 0 2 u o 0 " i / 1 r a / e p a d i p " / i , a / u i t i h i / f 2 p c r o o n b t e e " x , t . j s o n " , 0
2. Handling Parallel Requests# H C A { } T o c T n c " " } P t e e s ] / e s r e " " " 1 n s r r @ i t . t - o v c d y 1 - C r i o " p T o " c n : e 4 y n : e t " 0 p t " e " : 1 e r " : x h : o A t t " U l u [ " t A n a - t { : p u a p A h : t u p l e " / h t l l n h / P h i o t t l r o c w i t o o r a - c p c b i t O a : a e z i r t / l S e o i i / h e d n g o i o r / i n i s v j n i t i s : r f : c o e . 3 e n q i 0 2 u o 0 " i / 1 r a / e p a d i p " / i , a / u i t i h i / f 2 p c r o o n b t e e " x , t . j s o n " , 1
Troubleshooting# H C A { } T o c T n c " " } P t e e s ] / e s r e " " " 1 n s r r @ i t . t - o v c d y 1 - C r i o " p T o " c n : e 4 y n : e t " 0 p t " e " : 1 e r " : x h : o A t t " U l u [ " t A n a - t { : p u a p A h : t u p l e " / h t l l n h / P h i o t t l r o c w i t o o r a - c p c b i t O a : a e z i r t / l S e o i i / h e d n g o i o r / i n i s v j n i t i s : r f : c o e . 3 e n q i 0 2 u o 0 " i / 1 r a / e p a d i p " / i , a / u i t i h i / f 2 p c r o o n b t e e " x , t . j s o n " , 2
2. postMessage Reception Failure# H C A { } T o c T n c " " } P t e e s ] / e s r e " " " 1 n s r r @ i t . t - o v c d y 1 - C r i o " p T o " c n : e 4 y n : e t " 0 p t " e " : 1 e r " : x h : o A t t " U l u [ " t A n a - t { : p u a p A h : t u p l e " / h t l l n h / P h i o t t l r o c w i t o o r a - c p c b i t O a : a e z i r t / l S e o i i / h e d n g o i o r / i n i s v j n i t i s : r f : c o e . 3 e n q i 0 2 u o 0 " i / 1 r a / e p a d i p " / i , a / u i t i h i / f 2 p c r o o n b t e e " x , t . j s o n " , 3
まとめ# In the IIIF Authentication API 2.0 implementation, requests are processed in the following flow:
Initial Access → 401 with Probe ServiceProbe Service → 401 with Access ServiceToken Service → Login Page redirectLogin → JWT Token generationpostMessage → Token delivery to main windowAuthenticated Request → Protected resource accessBy implementing proper error handling and security measures at each step, you can build a safe and user-friendly authentication system.
References# 