search

aaronpk / indielogin.com

Sign in with your domain name
https://indielogin.com
MIT License
149 stars 24 forks source link

Update to use the token endpoint #121

Open anderspitman opened 3 months ago

anderspitman commented 3 months ago

Seeing some weird behavior while trying to implement IndieAuth support for obligator. The token request is coming back to my authorization endpoint. I've triple checked that I'm setting them to different values in my s. I'm sure it's a typo somewhere, but wanted to check and make sure there's no chance it's on the IndieLogin side.

anderspitman commented 3 months ago

Here's an example HTML response return from the user profile:

<!DOCTYPE html>
<html>
  <head>
    <link rel="indieauth-metadata" href="https://anderspitman.com/.well-known/indieauth-metadata">
    <link rel="authorization_endpoint" href="https://anderspitman.com/indieauth/auth" />
    <link rel="token_endpoint" href="https://anderspitman.com/indieauth/token" />
  </head>
  <body>
    <h1>Hi there</h1>
  </body>
</html>

The token requests are going to https://anderspitman.com/indieauth/auth

aaronpk commented 3 months ago

Yeah I think this is IndieLogin.com doing the older behavior described in the first IndieAuth spec. I'll do a pass on this to update it to the latest spec this week. Sorry about that.

anderspitman commented 3 months ago

No worries just thought I was losing my mind for a minute. 99/100 times this is a typo somewhere in my brand new code.

anderspitman commented 3 months ago

Ohhh I see, this behavior indicates it only wants the profile and not an access token: https://indieauth.spec.indieweb.org/#profile-url-response. I actually quite like the simplicity of that.

aaronpk commented 3 months ago

Yeah, the only downside is it means it's not compatible with OAuth 2.0 then. The theory was that you could deploy a site with only an authorization endpoint and no token endpoint.