HTTPS local callback url

thunderclient / thunder-client-support

Thunder Client is a lightweight Rest API Client Extension for VS Code.

https://www.thunderclient.com

Other

3.61k stars 126 forks source link

HTTPS local callback url #1480

Closed dimmaski closed 6 months ago

dimmaski commented 6 months ago

Question: v2.17.8 - free version

Issues using OAuth 2.0's callback url

I'm forbidden by policy to use external sources like https://www.thunderclient.com/oauth/callback for oauth callback, so I'm restricted to using http://localhost:6789/callback. The issue is that my OAuth server authorised callback list only allows https URLS, I cannot provide http://localhost:6789/callback as an option.

I've been bypassing the issue by adding https://localhost:6789/callback to the OAuth server authorised callback list and then changing the browser's URL, removing the S from httpS and by that process I'm able to get the token, but that is obviously not ideal.

Are there any alternatives to this issue?

One viable option would be to provide local certificates for the server running the https://localhost:6789/callback endpoint, but I'm not able to find that configuration.

Thank you

rangav commented 6 months ago

You can create your own server for auth callback and redirect to http://localhost:6789/callback

dimmaski commented 6 months ago

Thank you for your reply @rangav. So, to see if I got it straight.

I would create a server listening on port 4000 (for example)

I would configure my OAuth server authorised callback list to point to https://localhost:4000/callback.
On my Oauth configuration allow callback from http://localhost:6789/callback
Create a proxy to redirect https://localhost:4000/callback to http://localhost:6789/callback (using self signed certs)

Did I get your suggestion right? Is this setup common? I did not find any mention on other Git issues or documentation. It seems to be extra work. Are there any other options?

rangav commented 6 months ago

Yes the steps are right. This is workaround, if the existing solutions does not work. So it might have extra steps.

Create your own endpoint and add to auth callback list - https://localhost:4000/callback
Auth Tab in TC add callback url - https://localhost:4000/callback
redirect from - https://localhost:4000/callback?code=xyz to http://localhost:6789/callback?code=xyz

dimmaski commented 6 months ago

Ok, thank you for sharing the workaround, I think it will be helpful for lots of devs :). Just a final question, do you think that in the future thunder-client will support loading the certificates directly and using them for the callback endpoint, that would be great! Thank you