search

pow-auth / assent

Multi-provider framework in Elixir
https://powauth.com
MIT License
391 stars 45 forks source link

Allow passing access token to callback #34

Closed kanes115 closed 3 years ago

kanes115 commented 4 years ago

Right now assent assumes that the client will pass code in parameter list in the callback phase. There are cases, though, when the client has an access token already (assent does not need to fetch it and does not have the means to do so). Would it be possible and desirable to accept access tokens as well in OAuth2 strategy.

My specific use case is Facebook login on mobile devices where client side libraries only allow to fetch the access token straight away.

danschultzer commented 4 years ago

Yeah, that makes sense.

Currently Assent OAuth 2.0 strategy only supports authorization code grant flow. I'm not sure if this is implicit grant flow, but I'll dig into the facebook docs to see how I should deal with the callback phase.

danschultzer commented 4 years ago

So it looks like this would be specific to facebook instead of implicit grant flow:

https://github.com/simi/omniauth-facebook/blob/48cdde26c5fffab4fcc0f2a27e88601b245c0b9b/lib/omniauth/strategies/facebook.rb#L127-L151

https://github.com/facebookarchive/facebook-php-sdk/blob/8e7e7951e99d86b68ce1135537d559663d759af0/src/base_facebook.php#L477-L491

As I understand it, this decodes the short lived access token from a cookie using the client secret, and then uses it to generate a long lived access token. Not sure if necessary with Assent, but I guess it can't hurt.

Edit: Facebook also suggests using code grant flow https://developers.facebook.com/docs/facebook-login/security#codeflow. I'll have to test this manually to see how it all works.

Also, this lib is probably the best reference: https://github.com/facebook/php-graph-sdk/blob/6d1eb5a3861624cd0ff40c67e517de891d78134a/docs/reference/FacebookJavaScriptHelper.md

danschultzer commented 4 years ago

I've set up instructions for how to deal with Facebook JS SDK here: https://github.com/pow-auth/assent/pull/44

danschultzer commented 3 years ago

I'll close this as I believe both #44 and changes in the OAuth 2.0 strategy has made it very easy to handle with already fetched access token in client.

To recap:

  1. The Facebook strategy docs now highlights how to fetch the code client side to submit server side
  2. The Assent OAuth 2.0 strategy now supports any grant type with Assent.Strategy.OAuth2.get_access_token/3 to fetch the access token. Callback still uses the authorization code flow.
  3. Assent.Strategy.Facebook.get_user/2 could be used to fetch the user data with the access token.
  4. Passing an access token straight to the backend is not recommended unless you reverify: https://developers.facebook.com/docs/facebook-login/web/accesstokens#confirm There might need to be a special method in the facebook strategy to handle this case, as I believe this is a facebook feature and not part of the oauth2 specs.