Remove the authentication process for OAuth 2.0 #5
Conversation
* Change all `http://` urls to `https://` urls. * Replace `https` module of `request` module for https request. * Remove OAuth 1.0 module. * Remove consumer-key, comsumer-secret, yuser-secret and yuser-sessionHandle. * We do not need these variables anymore. * External OAuth 2.0 application must handle them. * Remove the codes to refresh userToken. * External app using OAuth 2.0 must handle it. * Set set new token using setUserToken API.
| oauth_session_handle: self.yuser.sessionHandle | ||
| }); | ||
|
|
||
| https.get('https://api.login.yahoo.com/oauth/v2/get_token?' + refresh_data, function(res) { |
There was a problem hiding this comment.
So we no longer need the refresh token when we move to OAuth2?
There was a problem hiding this comment.
To exchange the refresh token in OAuth 2.0, we need a redirectionUri and must handle Yahoo's response in it. So external app must handle the refresh token like below.
- [externalApp] Call some yfsapi API.
- [yfsapi] If session is expired, we return an error.
- [externalApp] Exchange the refresh token for new access token.
- [externalApp] Call yf.setUserToken(NEW_USER_TOKEN) API.
- [externalApp] Call some yfsapi API.
|
So I've been thinking a lot about this, here's my plan: I'm going to hold off on implementing OAuth2, simply because we cannot use client credentials to make public queries. This is a big issue for me as it will limit the ability to easily use the API. That said, I am going to take all of the OAuth specific stuff out of my API and that will be on the user to set up going forward. When I require the refresh token I am going to trigger an event that the user will have to catch in order to refresh the token (if the user is signed in). I plan to also keep a branch up to date next to "master" which I will call "oauth2" which will, when OAuth2 supports client credentials for the Fantasy Sports API, I will make the "master" branch of the project. Does that make sense? I hate not merging in your hard work, but for the API I just want to make sure it's easiest for the user. |
|
@whatadewitt Thank you a lot for your reply! |
|
Thank YOU for taking the time with the code!!! |
|
Thinking about it more... it's a bit of a catch-22... Best case for a user is for them to just have a client ID and secret and use that to query the API. If I remove all of the OAuth stuff, then I end up having the user needing to do some sort of OAuth for the client in their app, which doesn't make things as easy as possible for them... This is frustrating... |
|
... should be like Twitter where they just let you create these tokens :) |
|
@whatadewitt |
http://urls tohttps://urls.httpsmodule ofrequestmodule for https request.