search

mozilla / fxa-auth-server

DEPRECATED - Migrated to https://github.com/mozilla/fxa
Mozilla Public License 2.0
399 stars 121 forks source link

Add an /oauth/authorization route, authenticated with a sessionToken #2933

Closed vladikoff closed 5 years ago

vladikoff commented 5 years ago

As part of our quest simplify our OAuth infastructure and remove BrowserID, let's move the OAuth /authorization endpoint over to the auth-server and authenticate it directly with a sessionToken, rather than having to indirect through a separate services with a BrowserID assertion.

This supports the Fennec -> Fenix migration flow (since Fenix can use Fennec's sessionToken to authorize itself as a new client) as well as furthering broader architectural efforts to make OAuth the primary mechanism of authorizing things via FxA. Other consumers include the Desktop half of the pairing flow, which currently uses the BrowserID-authenticated /authorization route.

Ref: https://github.com/mozilla/fxa-auth-server/pull/2932 for a WIP PR.

(@vladikoff I edited your issue comment to add more details as part of breaking down https://github.com/mozilla/fxa-auth-server/issues/2547#issuecomment-468482625)

rfk commented 5 years ago

Vlad has deployed a WIP branch of this here: https://github.com/mozilla/fxa-auth-server/commits/feature.fenixmigrator