OAuth for server side apps -
i need interact api supports oauth2.
the problem is, write purely server side application should sit there without gui polling api every day.
the api gives me ability application token programatically, looks need implement entire gui flow subsequent access token. because need log in via application providers web based login screen.
it looks need access token, , copy out server side credential recreate it. if ever expires or goes bad, i'll need go via gui flow server side access token.
is understanding correct here feels clunky?
specifically:
can avoid implementing process link on application providers login form?
is right after doing this, have unpick access token , store within server side application. don't appear have control on whether expire?
i can see e.g. facebook support server side , client side flow. wonder if i'm coming against limitations in particular implementation of oauth 2?
i don't know how want app behave, 1 thing - have input user credentials once.
once authenticate , authorize (there lot of open questions on so, automatic authentication), app not access token, refresh token. refresh token need in use case. can store server side - refresh token not have expiration time. lives till user explicitly revokes permissions.
for oauth service provider there token exchange endpoint can exchange refresh token (refresh token + access token) pair. so, @ backend (your server) can @ time hit endpoint - short-lived access token , perform operation need to. saves effort of following gui flow every time.
see link - https://developers.google.com/accounts/docs/oauth2webserver#offline
edit - made changes after reading comment. need know how use refresh tokens in app.
Comments
Post a Comment