search

pow-auth / pow_assent

Multi-provider authentication for your Pow enabled app
https://powauth.com
MIT License
321 stars 50 forks source link

API use in iFrame #196

Open Lazarus404 opened 3 years ago

Lazarus404 commented 3 years ago

I'm trying to utilise this as part of an API server. The client accessing this is a SPA. Once I've called GET on the NEW endpoint, I open an IFrame and set its URL to the returned url value. However, after redirecting to https://github.com/login?client_id=..., which has a 200 status code, the IFrame shows github.com refused to connect.

Do you have any idea's? I'm not sure what to look for, since the network tab in Chrome shows everything returning correctly.

danschultzer commented 3 years ago

Iframes should not be permitted for OAuth 2.0 flow: https://tools.ietf.org/html/draft-ietf-oauth-v2-23#section-10.13

I believe Github sets the x-frame-options header to prevent clickjacking. So your only option is to either use the authorization url in the current window, or open a new one.