oauth2orize
oauth2orize copied to clipboard
OAuth 2.0 authorization server toolkit for Node.js.
After the conversation https://github.com/jaredhanson/oauth2orize/pull/148 I changed the pull request for backward compatibility of arity params.
http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-4.2.2 If scope is different from the app's requested scope, it's a required parameter (otherwise optional). Since the decision middleware doesn't explicitly handle scope, it has no way to tell...
Math.random() isn't a cryptographically secure random number generating, meaning that people could easily guess the seed by looking at the V8 chrome code and then generate their own tokens. Most...
Which would be the way to authorize automatically wihtou show the decision dialog? All examples i´ve seen seems to be outdated. Thanks, Rodrigo
Hello, I have a problem and i can`t get the access token.In other words i checked and i can`t make the exchange between the authorization code and the access token.I...
It's confusing that req.user is a client when doing a client credentials exchange. This makes for some messy checking when we want to determine if we are working with a...
Although I see `expires_in` being checked in tests, I do not see it returned with the access token. Is this an oversight?
I have successfully implemented an OAuth2 server in my application, I am trying to return the failure message to the user, such as 'Incorrect username/password', my local strategy looks like...
When you request an auth_code grant, there is a difference in the redirect between code and token. Code: https://github.com/jaredhanson/oauth2orize/blob/master/lib/grant/code.js#L138 Token: https://github.com/jaredhanson/oauth2orize/blob/master/lib/grant/token.js#L145 What is the reasoning for this difference?
oauth2orize middleware uses res.end to send back authorization responses. As a result, responses lack the trailing newline at the end, which makes using curl to test oauth endpoints "funny". It...