Comments (2)
Hi. Submitted a PR for review.
The additional code does the following:
- Moved the state code out of AuthContext and into the
useStorage
hook - Added
useCookieStorage
toHooks.tsx
that mirrors functionality ofuseBrowserStorage
- If
config.storage==='cookie'
thenuseStorage
uses the state foruseBrowserStorage
Optionally, config.baseDomain
can be set to manually set the cookie domain.
from react-oauth2-pkce.
Hi,
The library will not adopt cookie support at this point.
A few reasons:
- It's a non-recommended way of storing tokens (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps-14#section-9.1)
- It's a very uncommon for modern OAuth2 servers to use Cookies to send back tokens (do you have any examples?)
- Cross domain/subdomain tokens kind of defeats the purpose with OAuth2. Each application should have a token that is scoped to exactly that application only. Logging in and getting new tokens for each app should not be a big hurdle as it's common to have Cookies to authenticate towards the SSO auth-server.
Only reason to implement this would be to support some rare, old?, authentication providers, who are not following best practices. Which I'm not inclined to do.
I'd rather have this library support only recommended methods and pattern.
from react-oauth2-pkce.
Related Issues (20)
- Bug: "Bad authorization state" after periods of inactivity HOT 2
- Bug: rename "login" to "logIn" HOT 7
- Bug: Not providing a scope results in "scope=undefined" HOT 1
- Bug: Not possible to change storageKeyPrefix to anything other than 'ROCP_' HOT 1
- Bug: Nothing happens when using login() in Next.js HOT 1
- 💡 [REQUEST] - To refresh the access token without triggering login() HOT 2
- Bug: Fail to get token from a Spring Security server HOT 2
- Compatibility with ie11 HOT 1
- 💡 [REQUEST] - Add ability to add headers to requests HOT 6
- 💡 [REQUEST] - Scope parameter is not supported on an authorization code access_token exchange request HOT 8
- Bug: Client authentication with confidential access isn't working HOT 6
- Bug: Redirects replace instead of creating a history entry HOT 2
- 💡 [REQUEST] - Parse (refresh) token expiration from token payload HOT 5
- 💡 [REQUEST] - Refresh access token without resetting the refresh token HOT 1
- Bug: "codeVerifier" and "state" are stored in sessionStorage despite "storage" parameter being "local" HOT 4
- Bug: Does not work correctly if routing type is hash HOT 2
- 💡 [Feature] - Ability to send custom headers in the authorization, token requests HOT 6
- 💡 [REQUEST] - Pass extra parameters to login()-function
- 💡 [FEATURE] - Option in login()-function to not redirect, but instead do it in an iframe or popup HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from react-oauth2-pkce.