Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OnSuccess would be better to return Credential containing method to get user profile #91

Closed
ChrisCho-H opened this issue Sep 20, 2022 · 2 comments
Assignees
Labels
enhancement New feature or request question Further information is requested

Comments

@ChrisCho-H
Copy link

ChrisCho-H commented Sep 20, 2022

Hi, thanks for your great work. This helps me a lot!
However, I think it would be better to add the feature to get user profile when onSuccess is called, because most of client dev will use the info of user profile, much more than token or clientId.
it can be additional, for instance, return Credential which contains getProfile(), so that dev can easily get the result of user profile.
This feature can be simply added with logic below.

const base64Payload = response.credential.split('.')[1]; //value 0 -> header, 1 -> payload, 2 -> VERIFY SIGNATURE

const payload = Buffer.from(base64Payload, 'base64'); 

const userProfile = JSON.parse(payload);

return userProfile;

If I miss something, please let me know!

@ChrisCho-H ChrisCho-H changed the title OnSuccess return object would be better if user profile, not Credential itself OnSuccess would be better to return Credential containing method to get user profile Sep 20, 2022
@GhazanfarKhan
Copy link

Yes I also needed that

@MomenSherif
Copy link
Owner

Hello @Hyunhum
Thank you for your suggestion,

I tried to make the package to have a similar API for all cases

  1. GoogleLogin
  2. useGoogleLogin (implicit flow)
  3. useGoogleLogin (authorization code flow)

the issue was, for each case, google returns a different response
for GoogleLogin google just returns id_token which includes user info directly encoded in base64 which we can decode in multiple ways (one of them is your suggestion)
But in useGoogleLogin

  • implicit flow -> google returns access_token to communicate with google APIs, & to get profile info we can send HTTP request to https://www.googleapis.com/oauth2/v3/userinfo
  • authorization code flow -> google returns code which we can exchange with our backend, and for profile, info backend can decode id_token on the server or we can decode id on the client

if I made decoding id_token for first case only as it's direct return from google, Any user of the package will expect the same behavior for the hooks to return also user profile

so I sticked with google response & decoding is the responsible of the developer (which is small step & easy)

@MomenSherif MomenSherif self-assigned this Sep 24, 2022
@MomenSherif MomenSherif added enhancement New feature or request question Further information is requested labels Sep 24, 2022
dak2 added a commit to dak2/shortcut_master_web that referenced this issue Jul 2, 2023
GoogleLoginコンポーネントだとユーザー情報のcredentialsが返却されるが、デコードするとユーザー情報が簡単に閲覧できてしまうので、コードのみを返却する形に変更
バックエンドでこのコードを利用してユーザー情報を取得する

ref.
 - MomenSherif/react-oauth#9 (comment)
 - MomenSherif/react-oauth#91 (comment)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request question Further information is requested
Projects
None yet
Development

No branches or pull requests

3 participants