search

openid / AppAuth-JS

JavaScript client SDK for communicating with OAuth 2.0 and OpenID Connect providers.
Apache License 2.0
977 stars 162 forks source link

What format of redirect_uri is possible to use #86

Open Jenan opened 5 years ago

Jenan commented 5 years ago

I have tried to use the sample electron app. In this sample is used for the redirect_uri following link: http://127.0.0.1:8000 - and after some workflow is showed the message: Close your browser to continue. I think - it isn't very good UX. :-)

Is it possible to use another type of processing of response then this approach with localhost - some approch with automatic closing of browser?

I have seen some redirect_uri which looks like this: com.mycompany.nativeapp://cb - where broswer is probable open inside of native app - is it possible to achieve this behaviour in this library?

Thanks for clarification!

tikurahul commented 5 years ago

You can do much better than that. You can have the server return a static HTML page or even run some JavaScript to close the tab automatically.

Also, you should take a look at the Electron sample app. It intercepts the localhost redirect and brings the app back into focus.

tikurahul commented 5 years ago

Custom scheme callbacks are also possible. You have to define a handler and have the app intercept a request. However the problem of the open tab still remains.

Jenan commented 5 years ago

Is it possible to open OP inside of electron app or is it recommended to use new instance of browser tab?

tikurahul commented 5 years ago

You should use a new instance of a browser tab (because that is where the user probably has already signed in). This is the whole point of AppAuth - is to take app out of the flow and just provide a callback when the authorization step is done. That way the user is free to do things like use U2F keys etc without you having to explicitly provide support for it.

AppAuth does not support the flow you are asking for - for this reason. This is also a lot more convenient for the user as they will not be asked to enter a password if they already signed in. So UX wise I would argue that this is much better. 😀

Jenan commented 5 years ago

Oki. I see - thanks.

Jenan commented 5 years ago

One additional question for clarification - I have tried to create some js for closing the browser window but it seems that doesn't work reliably. Do you have some tip for this automatic closing of browser window? If I understand correctly - for authorization request to the OP is used the browser window - not inside native app but whole browser especially for SSO. I have found some examples for electron app - where it is used browser inside app like this - https://github.com/auth0-blog/electron-openid-oauth/blob/master/frontend/main/auth-process.js#L17-L39 What do you think about it - Am I able use similar approach with this library? What about React Native or similar frameworks for building native mobile apps - how can I working with final success redirect uri in React Native app - will I force to close browser in mobile app as well? Thanks.

BTARPAR commented 4 years ago

You can do much better than that. You can have the server return a static HTML page or even run some JavaScript to close the tab automatically.

Also, you should take a look at the Electron sample app. It intercepts the localhost redirect and brings the app back into focus.

I am trying to do the same thing. I've hosted my static page on the server and in redirect_uri I am passing static URI but it not returning the response but if I replace it back to 127.0.0.1:8000 its working fine? Can you provide an example how you are able to redirect to static page and also able to get a response please