Proper method for accessing OAuth2 tokens via javascript

Question

I understand the basics of oauth, and I've used it in application before, but never like this.

I've got an oauth2 based api I wrote, and I'm writing a javascript application (in backbone.js), and I want to access the api with it.

My problem is that I need to obtain an access token for the js app. Normally I'd request a token with something like example.com/oauth2/token?client_id=<client-id>&client_secret=<client-secret>&....

If my client secret is supposed to be, well, secret, should I be putting it in my application js?

What's the proper way to do oauth2 over javascript?

My users/app is also the "source" for oauth, so I'm not going to be doing any kind of 3rd party user authentication, as they'll already be logged into the site.

Jordão · Accepted Answer · 2011-10-03 16:21:32Z

3

I think you should obtain the access token from the server. This way, your client secret is kept secret on the server. In other words, your server will serve as a proxy for the OAuth exchange.

edited Oct 3, 2011 at 16:21

answered Oct 3, 2011 at 16:08

Jordão

56.8k13 gold badges118 silver badges147 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

zombor Over a year ago

This is what my initial thinking was. Have a generic endpoint on the server that I can request, and spit out a new access token. Right now, the server is the user, but that might change.

3emad Over a year ago

here is how facebook apps handles it on the javascript side: developers.facebook.com/docs/authentication search for "Client-side Flow"

zombor Over a year ago

In my case, there's no user login dialog. My application is the user client.

Collectives™ on Stack Overflow

Proper method for accessing OAuth2 tokens via javascript

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related