node-oauth / express-oauth-server

🔒 Complete, compliant and well tested module for implementing an OAuth2 Server/Provider with express in node.js
https://www.npmjs.com/package/@node-oauth/express-oauth-server
MIT License
27 stars 8 forks source link

How run examples? #21

Open mvictorl opened 8 months ago

mvictorl commented 8 months ago

How run postgres example?

jankapunkt commented 8 months ago

I'm investigating, in the meantime I'm updating this package to drop unnecessary dependencies

binajmen commented 7 months ago

@jankapunkt Do you have a working example you're using in production ? I'm having difficulties to wrap my head around the correct workflow, which routes should be created, how they're interconnected. A minimal working example would be greatly appreciated!

jankapunkt commented 7 months ago

The current examples are out-of-date, which is why I removed them in the latest PR #22 and will move them to the examples repository, once they're updated.

You could test the 4.0.0-rc.0 release and let me know if things are working so I can publish 4.0.0 and move on to, for example, the examples

jankapunkt commented 7 months ago

@binajmen which workflow do you intend to implement? Did you already read through the RFCs and other OAuth resources on how the workflows generally work?

binajmen commented 7 months ago

Yes I already used several provider in the past (as the client), so I have a correct understanding of the workflow. I would like to implement the authorization code flow with refresh token for my own authorisation provider.

  1. TP (third party) send the RO (resource owner) to the AP (oAuth Provider) with state, client_id, etc.
  2. RO log himself if not logged in yet
  3. RO approve access
  4. RO redirected to TP callback (based on the redirect URI) with an authorization code
  5. TP use the code to request AP an access + refresh token using the code
  6. TP can access resource from RO
jankapunkt commented 7 months ago

I think you can take a look at liquid: https://github.com/shrihari-prakash/liquid the owner is also part of our org. Note that this uses the oauth-server directly, as opposed to using it with express. However, the express adapter is only a wrapper so no magic happening there.