node-oauth2-server icon indicating copy to clipboard operation
node-oauth2-server copied to clipboard

Recommended user registration/authorization flow

Open vancouverwill opened this issue 6 years ago • 0 comments

The documentation recommends using authorization grant type to register user. I tried this flow but in Authorization Handler it's default action is to authenticate client before authorizing which doesn't make sense see https://github.com/oauthjs/node-oauth2-server/blob/e1f741fdad191ee47e7764b80a8403c1ea2804d4/lib/handlers/authorize-handler.js#L87

However I found a workaround on line https://github.com/oauthjs/node-oauth2-server/blob/e1f741fdad191ee47e7764b80a8403c1ea2804d4/lib/handlers/authorize-handler.js#L42 there is the option to pass your own authenticateHandler which returns a user and they have recently added this to the docs see https://oauth2-server.readthedocs.io/en/latest/api/oauth2-server.html?highlight=authenticateHandler

However further down in the authorization workflow it blocks any grant type which is not of authorization_type see https://github.com/oauthjs/node-oauth2-server/blob/e1f741fdad191ee47e7764b80a8403c1ea2804d4/lib/handlers/authorize-handler.js#L184,

We want to use password or client_credentials grant and authorize when the user registers, so not sure how authorize should be used (note there are quite a few questions about this open here about authorization such as https://github.com/oauthjs/node-oauth2-server/issues/494).

vancouverwill avatar Feb 13 '19 18:02 vancouverwill