New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

`Google.retrieveCredential` should take a secret. #2118

Closed
tmeasday opened this Issue May 6, 2014 · 8 comments

Comments

Projects
None yet
4 participants
@tmeasday
Contributor

tmeasday commented May 6, 2014

Google OAuth credentials are stored with a secret, yet https://github.com/meteor/meteor/blob/devel/packages/google/google_server.js#L81-L83 doesn't take a secret as an argument.

@estark37 estark37 closed this in 0c479a2 May 6, 2014

@estark37

This comment has been minimized.

Contributor

estark37 commented May 6, 2014

Thanks @tmeasday! Fixed in all the OAuth service provider packages.

@tmeasday

This comment has been minimized.

Contributor

tmeasday commented May 6, 2014

No worries. PS, while we are on the subject, it'd be nice to be able to get the credential secrets (on the client) and the credential result (on the server) more than once.

Some use cases:

  1. In DM [1] we want to check that the MD user exists before logging them in (try logging in here http://book.discovermeteor.com) -- right now we do that with a second method call that checks the DM account they are trying to use.
  2. When a user signs up to DM, we already have a passwords account for them, and they click a link from Gumroad. We want to pop the oauth dialog, attach the MD user to the passwords account, then log them in as the user. Again, we do it with a second method call that inspects the credentials.

[1] We just launched with MD accounts btw :)

@jordangarside

This comment has been minimized.

jordangarside commented Jun 26, 2014

Do either of you, @estark37 or @tmeasday, know how I can get access to the credential secret on the server when I use requestCredential() on the client?
After this fix I need it for retrieveCredential. :p

For more detail I posted the question on stackoverflow http://stackoverflow.com/questions/24428130/how-can-i-get-the-credential-secret-in-meteor-when-i-do-facebook-requestcredent

@tmeasday

This comment has been minimized.

Contributor

tmeasday commented Jun 26, 2014

@jordangarside I think what you want is OAuth._retrieveCredentialSecret(token); -- underscored so use at your own risk...

@jordangarside

This comment has been minimized.

jordangarside commented Jun 26, 2014

@tmeasday That'll do it, thanks so much!
Why use at your own risk though?
I'm just calling it on the client and immediately passing it to the server, are there any dangers in that?

@tmeasday

This comment has been minimized.

Contributor

tmeasday commented Jun 26, 2014

Oh, I just meant that it's an _ underscore method so can change at any time in a future release without warning.

@jordangarside

This comment has been minimized.

jordangarside commented Jun 26, 2014

Ohh, for sure, thanks a ton!

@keslert

This comment has been minimized.

keslert commented Aug 8, 2015

@tmeasday This method no longer exists. What is the recommended way for retrieving the credential secret now?

[edit] Looks like it has to be called from the client.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment