OAuth for Desktop apps?

user_292291 0
Viewed 24927

i wonder how do desktop apps without any domain names use oauth? or is it not supposed to be used this way? if so what do i use? say for tumblr they have an authentication api so i will have to put the username and password in the url/query string?

i am thinking of using WPF/Adobe AIR. how does something like tweetdeck work?

oauth
6 Answers

I've been puzzled by the same question about lack of domain or app url, but it turns out redirection is not the only possible way to complete OAuth authentication process.

I.e., when webapp requests access it provides callback url: the one user will be redirected to when process is completed. That's how webapp know that everything's done.

But you can't redirect to application on user's machine. Thus, there's another way: upon successful authentication server presents special code to the user. Then user copies this code and provides it to application.

You can see both ways described in specification draft.
Also, here's an example of this authentication flow with twitter.

user_3305650

For a desktop app where a user needs to authenticate himself, you will usually want to use the Authorization code flow.

The approach goes roughly like this:

  1. setup a temporary webserver that listens on the loopback interface
  2. present the login page to the user (either in an embedded browser control or an external browser), with the URL of your temporary webserver as redirect_url
  3. upon successful login, the user will be redirected to your temporary webserver and you can obtain the access code from the code query parameter
  4. Using the access code, you can obtain a token and start making requests using it
  5. Shutdown the temporary webserver

Please note that you will have to allow localhost as redirect URL in your identity provider, in ordrer for this approach to work.

For further details, please take a look at these sample apps from Google.

user_46333260
Related