Access authorization on each "authorize" call about api-cdi HOT 6 CLOSED

I thought the same, it should only ask for authorization the first time or when the requested scopes changed.

from api-cdi.

The authorization is stored on ArenaNets side but there seems to be no check whether an authorization was granted earlier or not. (It has to be stored because of the 'offline' scope and the possibilty to revoke authorization.)

I would agree with you. This behavior is common in most implementations. The current behavior can confuse end users.

from api-cdi.

This is intended -- if you want to persistently log in a user, you should include the offline scope in your authorization request, then store the returned refresh token. You can use the refresh token forevermore to get new access tokens without prompting the user (at least, until they revoke your app).

There are more details in RFC 6749 §1.5 and §6.

(EDIT: though this behavior isn't really set in stone).

(EDIT2: okay, after an internal discussion I have been swayed on this matter (blame @tivac) and we'll change the behavior so that the account site only prompts for authorization if there are new as-yet-unauthorized scopes requested).

from api-cdi.

What we are trying to do is to use OAuth as authentication and not for accessing the api.

Lets say the user registers for our app using the OAuth login, authorizing our app with all permissions we need. We can now use his account id as user id and store stuff related to him in the database (not from the api, lets say comments, avatar, ...).

Then he wants to login again (possibly from a different PC), again using OAuth. He needs to authorize the app again, even though he already did so when he registered. We would use this new access token to get his account id (=user id) to get all the data about him from our database.

What we want is to ask the user once for authorization, to get access to all api endpoints we need for our app, and after that just login the user (just show the login page and instantly redirect back after successful authentication, skipping the app authorization step when the app is already authorized and the scope didn't change).

Edit: I wrote this before i read your second edit @lye, good to hear 👍

from api-cdi.

What we are trying to do is to use OAuth as authentication and not for accessing the api.

Yeah, that's basically the argument that @tivac made. Apparently our backend already has support for this, so it's not even that much work to expose it. Will try to get it out sometime soon™.

from api-cdi.

The fix for this is now deployed -- if you've previously approved a set of scopes for an application, it'll skip future authorization prompts (unless the application's permissions are revoked).

I took a page from Google's OAuth2 implementation and added a feature that lets you bypass this behavior -- if you put approval_prompt=force in your /oauth2/authorize call it will always present the user with the authorization page. This is useful for e.g., testing.

from api-cdi.