How to handle OAuth flow with Doorkeeper in API Mode?

user_4333030 0
Viewed 642

The scenario is simple:

  • A Rails API-only server with a Doorkeeper provider
  • A mobile app and a SPA (let's say React) with users that want to be registered and logged in using email and password

When you have a normal Rails Stack, you need to define an authorizeUrl where users are redirected to provide their credentials and return to the Web/Mobile App with an authorizationCode. In API mode basically your 'authorizeUrl' is located inside the same app.

What's the appropriated way to handle OAuth flow when your provider can't serve a login page (because is an API-only server)

doorkeeper single-page-application reactjs oauth-2.0 ruby-on-rails
1 Answers

You would have to build a login form in React, which send a HTTP POST request to get a OAuth token, say on /oauth/token, with credentials entered by user (in request body, alongside of client id/secret (depending on your OAuth server configuration).

Then on response you will get an access token, which you can add in authorization header on each subsequent request, so your server will know its legitimate request.

Typically, if you are using Axios as HTTP client the access token could be added to each request using an interceptor (like explained here : https://medium.com/swlh/handling-access-and-refresh-tokens-using-axios-interceptors-3970b601a5da).

This is "standard" OAuth workflow, I'm not sure if your backend stack implies some customization regarding authentication, but it seems that this workflow would still be valid.

user_22955490
Related