Comments (7)
Agree, this should be in there.
from oauth2.
Similar case in oauth2:authorize_code_grant/4, it always issues a refresh token when it is optional in the specification. I see four possible solutions:
- Making two versions of authorize_password and authorize_code_grant. I don't like it because they would be redundant, only different in wether they use issue_token or issue_token_and_refresh.
- Add an extra flag parameter to these functions, to tell them wether they should issue a refresh token or not. This is what I'm currently using but I don't really like it, I don't think it's "elegant".
- Pass issue_token or issue_token_refresh as an argument to authorize_password and authorize_code_grant. I think it's a too fancy and complex solution for a small problem, I don't see the point of so much flexibility if there are just two posibilities.
- Take issue_token and issue_token_and_refresh out of authorize_password and authorize_code_grant, so developers authorize the grant and then explicitly call the function to issue the token. We would have to change every other oauth2 function to be consistent with this new way. This is my favourite, IMHO it makes perfect sense to separate the request verification from the issuing of tokens and codes.
What do you think?.
from oauth2.
I agree that suggestion 4 is probably the way to go.
from oauth2.
Good, I will work it out and open and PR.
from oauth2.
Awsome, great work Ivan!
from oauth2.
See PR #25
from oauth2.
Merged
from oauth2.
Related Issues (20)
- Neither oauth2:issue_code_grant/3 nor /4 verify the scope HOT 1
- Add Context argument to all oauth2 and oauth2_backend API functions HOT 2
- Adding a test/sample of application-only-auth to twitter? HOT 1
- expires_in parameter is converted to a binary by oauth2_response:to_proplist/1 HOT 1
- Scope special case for privilege sets HOT 3
- Canβt refresh access tokens generated with Resource Owner Password Credentials Grant and oauth2:authorize_password/4 HOT 2
- Can't see how and why oauth2_backend:verify_resowner_scope/3 returns a client HOT 2
- Remove resource owner authentication HOT 1
- Remove get_redirection_uri not needed
- authorize_password/7
- Refresh token
- feature request: jwt support HOT 8
- Publish to hex.pm HOT 2
- Add link to cowboy_oatuh
- type map(_,_) undefined with Erlang 18 HOT 1
- Release request HOT 2
- 4.2.1. Authorization Request - client_secret is required? HOT 2
- token revocation by a user
- Update the upstream?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from oauth2.