I'm trying to authenticate against Twitter using Ember Torii and Ember Simple Auth. However, I'm not sure how to properly close the authentication popup once the user has been authenticated. My code:
//app/authenticators/torii.js
import {inject as service} from '@ember/service';
import Torii from 'ember-simple-auth/authenticators/torii';
export default Torii.extend({
torii: service(),
ajax: service(),
authenticate() {
const ajax = this.get('ajax');
return this._super(...arguments).then((data) => {
console.log('Authorization data:');
console.log(data);
if(data.provider === "twitter" && data.code) {
return {
accessToken: data.code,
provider: data.provider
};
}
//This is for OAuth2 providers e.g. Facebook
return ajax.request(
'http://localhost:8080/api/1/auth', {
type: 'POST',
dataType: 'json',
crossDomain: true,
contentType: 'application/json',
data: {'provider': data.provider, 'authorizationCode': data.authorizationCode}
}).then((response) => {
return {
accessToken: response.token,
provider: data.provider
};
});
});
}
});
//config/environment.js
.......
providers: {
'facebook-oauth2': {
apiKey: 'xxxxxxxxxxxxxx',
scope: 'public_profile,email'
},
'twitter': {
requestTokenUri: 'http://localhost:8080/api/1/auth/twitter/'
},
//app/torii-providers/facebook-oauth2.js
import { computed } from '@ember/object';
import FacebookOauth2Provider from 'torii/providers/facebook-oauth2';
export default FacebookOauth2Provider.extend({
redirectUri: computed(function() {
return [
window.location.protocol,
'//',
window.location.host,
'/torii/redirect.html'
].join('');
}),
fetch(data) {
return data;
}
});
From my understanding, the following happens in case of authentication using Twitter:
- User clicks on an UI element to initiate the authentication flow. Ember Torii creates a popup and does a GET request to
requestTokenUri. The API back-end generates theoauth_tokenrequired by Twitter and redirects to Twitter login page withoauth_tokenas query parameter. - The user logs in. Assuming a successful login, Twitter then redirects the browser popup to the configured
Callback URLon the API backend along withoauth_tokenandoauth_verifierparameters. - The back-end API's
Callback URLreceives these parameters and exchanges these foroauth_tokenandoauth_token_secretthat are stored in the back-end.
My question is basically, what happens next and how to cleanly and securely close the pop-up and initialize the session:
My back-end converts the token generated in 3 above to an internal JWT token and re-directs the browser pop-upto torii/redirect.html?code=<<JWTTOKEN>>. However, when the browser pop-up closes, Torii tries to re-authenticate the given token by calling authenticate method, which is not required. I've put in a workaround as show above in app/authenticators/torii.js. Is this correct? Is there a better way?
Aucun commentaire:
Enregistrer un commentaire