Closed coder13 closed 4 years ago
For this particular application, I don't see why we'd need anything more than public
and email
. Lets stick with that.
Relevant code for WCA auth is here: https://github.com/cubing/algdb/blob/main/backend/functions/src/services/auth/auth.service.ts#L67
Just need to generate an application id @saranshgrover what would be a good redirect_uri for local testing? Maybe localhost:3000/wca-redirect
?
Also, when the user has successfully authenticated, they will get a bearer access token that expires in 7 days. What do you think about setting the expiration to 30 days instead?
Relevant code for WCA auth is here: https://github.com/cubing/algdb/blob/main/backend/functions/src/services/auth/auth.service.ts#L67
Could you use staging.worldcubeassociation.org
for development?
Just need to generate an application id @saranshgrover what would be a good redirect_uri for local testing? Maybe
localhost:3000/wca-redirect
?
Yeah wca-redirect
works fine.
Also, when the user has successfully authenticated, they will get a bearer access token that expires in 7 days. What do you think about setting the expiration to 30 days instead?
This is fine by me, though it may be nice if we could implement a refresh_token
mechanism or even sessions.
Also, when the user has successfully authenticated, they will get a bearer access token that expires in 7 days. What do you think about setting the expiration to 30 days instead?
This is fine by me, though it may be nice if we could implement a
refresh_token
mechanism or even sessions.
I always found the refresh_token to be kinda redundant because if you have a refresh_token, it is basically the same as having an access_token? Anyway, I implemented the WCA auth in 77d19219038698772f10361f24e778fdb2e33ddc
Feel free to re-open if this is still not considered finished.
We decided to use WCA authentication for our user system.
In order to accomplish this, we'll need a way to interact with the database via the server. We should keep in mind which scopes we use and how we use them. I had a user get curious why I asked for the email scope with letscube when I didn't need to at all.