Receiving an OAuth callback in a webapp?

[Michael Bishop]

Hi All,

I've been working on getting my web app to authenticate with Twitter using OAuth. I've been able to use systemXHR to retrieve temporary tokens and have also been able to open a new webpage in my app that shows twitter's login page.

Now, after the user signs in, twitter wants to redirect that page to a callback url.

1. How do I make that callback url show my app?
2. How do I, within my app, retrieve the authentication token (which is a parameter that twitter appends to the callbackURL)

On iOS, apps can register with a custom URL scheme that will launch them. Is there a similar facility on FirefoxOS. How do I intercept that url? Additionally, what exactly does the "origin" parameter in the manifest.webapp file enable?

Any thoughts you have would be much appreciated. I'm very close to finishing and will gladly publish the source once it works.

Thank you,

_ michael

---
Michael Bishop
Hitpoint Studios
http://www.hitpointstudios.com

[Luca Greco]

On Fri, Jun 28, 2013 at 4:08 PM, Michael Bishop <mbi...@hitpointstudios.com
> wrote:

> Hi All,
>
> I've been working on getting my web app to authenticate with Twitter using
> OAuth. I've been able to use systemXHR to retrieve temporary tokens and
> have also been able to open a new webpage in my app that shows twitter's
> login page.
>
> Now, after the user signs in, twitter wants to redirect that page to a
> callback url.
>
> 1. How do I make that callback url show my app?
> 2. How do I, within my app, retrieve the authentication token (which is a
> parameter that twitter appends to the callbackURL)
>
>

I've never tried directly yet, but App Manifest doc page on MDN seems to
describe a "redirects" manifest attribute to cover this use case:

- https://developer.mozilla.org/en-US/docs/Web/Apps/Manifest#redirects

As an real usage example, you can take a look to the "communication gaia
app" which use redirects to connect
Facebook using OAuth:

-
https://github.com/mozilla-b2g/gaia/blob/master/apps/communications/manifest.webapp#L141
-
https://github.com/mozilla-b2g/gaia/tree/master/apps/communications/redirects

I hope this helps,
Luca

--
Luca Greco @ Alca Società Cooperativa

[Michael Bishop]

The Gaia source looks like a treasure trove of useful information. Thanks!

_ michael

---
Michael Bishop
Hitpoint Studios
http://www.hitpointstudios.com

On Friday, June 28, 2013 at 10:25 AM, Luca Greco wrote:

[Kevin Grandon]

With the systemXHR I believe you will still need to run an external server (what we do with communications app). One possible way might be to request the browser permission and listen for mozbrowserlocationchange.

This is what we're doing with the calendar application, I have no idea if it will work for your use case. Example: https://github.com/KevinGrandon/gaia/blob/master/apps/calendar/js/oauth_window.js#L112

Best,
Kevin

----- Original Message -----
From: "Michael Bishop" <mbi...@hitpointstudios.com>
To: dev-w...@lists.mozilla.org
Sent: Friday, June 28, 2013 7:08:21 AM
Subject: Receiving an OAuth callback in a webapp?

Hi All,

I've been working on getting my web app to authenticate with Twitter using OAuth. I've been able to use systemXHR to retrieve temporary tokens and have also been able to open a new webpage in my app that shows twitter's login page.

Now, after the user signs in, twitter wants to redirect that page to a callback url.

1. How do I make that callback url show my app?
2. How do I, within my app, retrieve the authentication token (which is a parameter that twitter appends to the callbackURL)

On iOS, apps can register with a custom URL scheme that will launch them. Is there a similar facility on FirefoxOS. How do I intercept that url? Additionally, what exactly does the "origin" parameter in the manifest.webapp file enable?

Any thoughts you have would be much appreciated. I'm very close to finishing and will gladly publish the source once it works.

Thank you,

_ michael

---
Michael Bishop
Hitpoint Studios
http://www.hitpointstudios.com

_______________________________________________
dev-webapps mailing list
dev-w...@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-webapps

[Kumar McMillan]

On Jun 28, 2013, at 9:08 AM, Michael Bishop <mbi...@hitpointstudios.com> wrote:

> Hi All,
>
> I've been working on getting my web app to authenticate with Twitter using OAuth. I've been able to use systemXHR to retrieve temporary tokens and have also been able to open a new webpage in my app that shows twitter's login page.
>
> Now, after the user signs in, twitter wants to redirect that page to a callback url.
>
> 1. How do I make that callback url show my app?
> 2. How do I, within my app, retrieve the authentication token (which is a parameter that twitter appends to the callbackURL)

Hi.
I assume you are dealing with a packaged app, not a hosted app? A hosted app does not have any of these problems -- if possible, use a hosted app (you can still cache it to make it perform like a packaged app).

>
> On iOS, apps can register with a custom URL scheme that will launch them. Is there a similar facility on FirefoxOS. How do I intercept that url? Additionally, what exactly does the "origin" parameter in the manifest.webapp file enable?

The origin parameter is not yet documented. It will be supported only in Firefox OS 1.1, not 1.0 (which is the version shipping). The origin is indeed intended to solve your exact problem and you can read about it here https://bugzilla.mozilla.org/show_bug.cgi?id=852720 The patch may also help to understand it https://hg.mozilla.org/releases/mozilla-b2g18_v1_1_0_hd/rev/0aee0700f68b

-Kumar

[Michael Bishop]

Sadly, this is a packaged app (though a privileged one).

_ michael

_ michael

---
Michael Bishop
Hitpoint Studios
http://www.hitpointstudios.com

On Friday, June 28, 2013 at 10:58 AM, Kumar McMillan wrote:

> > dev-w...@lists.mozilla.org (mailto:dev-w...@lists.mozilla.org)
> > https://lists.mozilla.org/listinfo/dev-webapps
> >
>
>
>

[Kumar McMillan]

On Jun 28, 2013, at 10:26 AM, Michael Bishop <mbi...@hitpointstudios.com> wrote:

> Sadly, this is a packaged app (though a privileged one).

ok, then you need the origin. I'm not sure if there is any secure way to work around it until you have the origin support in 1.1. There are plenty of insecure ways :)

>>> https://lists.mozilla.org/listinfo/dev-webapps
>

[reinv...@gmail.com]

I've done this in a little Foursquare app called Checkin that you can see at:

https://github.com/reinvented/checkin

Take a look at the OAuth-related code for Foursquare:

https://github.com/reinvented/checkin/blob/master/www/js/checkin.js#L136