Getting started

[lukepuplett]

Hey, it seems like a lot of hard work has gone into this and it could be what I need.

I'm building my first Deno + TypeScript + Svelte web app (I'm C# usually). I need to build a login with Google feature. In C# we have (overly large and opaque) frameworks that do this for us.

Though when OAuth was new, I did read the spec and implement it by hand in C#. It was nice because I could keep the code focused and step through it all in a debugger.

I'm looking to do the same in Deno, create the redirect URLs, handle callbacks and sign/verify parameters, exchange tokens etc. and I feel I just need a handful of helpers.

• Is this the package I need?
• If so, how do I help myself using what's available today?

I've looked through the names and documentation for the public functions and some look like they might be what I need but right now it's too much of a leap to putting it together, I need an on-ramp.

Thank you.

[panva]

Hi @lukepuplett,

It seems this is the package you need. Although I need to point out it's not really intended for direct consumption. README reads:

This software is a collection of routines upon which framework-specific client modules may be written.

If you're well familiar with the specifications and profiles this software targets you certainly could use it directly.

Do you possibly have any concrete questions? I would be happy to answer those.

[lukepuplett]

Thank you. I'm going through each public type, it's like an OAuth Lego set, and looking at its doc and I think I can put something together. OAuth is quite a simple dance and it's lovely to fully understand what's happening and to own that code. Thanks for getting back to me!

Keep this open for a week as it's all very new. I keep losing days down other rabbit holes.

[lukepuplett]

But that is actually correct, isn't it? Isn't the value exactly the one you pre-registered and therefore used as the redirect_uri parameter at the authorization server's authorization endpoint? (e.g. in the authorization request?).

Oh I'm sorry. I find all the naming of all the requests and URLs confusing; there's the redirect my app makes to send the user's browser to the authorization page, and then Google also redirects back to my app with the auth code etc. Two "redirect URLs". So I thought it was the authorization URL that I redirected the user to!

On the point about Google's documentation, they don't mention PKCE at all, nor any of its query parameters, which we've discovered it actually does support.

Anyone reading Google's doc and using your library will be confused because PKCE is not mentioned at all, but is mandatory on your library. Hope that makes sense. Thanks Filip.

[panva]

Sure, notice that my sample also checks discovery result for PKCE support.

oauth4webapi/examples/code.ts

Lines 17 to 21 in d624860

	if (as.code_challenge_methods_supported?.includes('S256') !== true) {
	// This example assumes S256 PKCE support is signalled
	// If it isn't supported, random `nonce` must be used for CSRF protection.
	throw new Error()
	}

[lukepuplett]

Oh wow. I never saw there were samples :-D thanks!!

[panva]

Well, they're not executable samples but they show you what to do when.

[lukepuplett]

Just dropping you a note to say that I have it all working and thanks for your time today.