[Authorisation Code flow] redirect_uri shouldn't be hard-coded to localhost

[tonycpsu]

Is there a reason that the redirect_uri is hard-coded here? I see that you can set the endpoint and the port, but why not the entire URI?

[Colin-b]

It's hardcoded to localhost as this is where the local server is started in order to retrieve the code. I have access to an okta Auth code flow app and I plan to start testing this one a bit more.

If you have a use case were you need to set a specific host then I am more than happy to make the modification, you can provide a PR as well if you have some time :-)

[tonycpsu]

Yeah, I can get your a PR for it, but I'm not quite sure my use case is legit, and I'm actually not quite certain this module is what I need for this application, so let me explain a bit.

I've developed an application for watching MLB.tv baseball games. The authentication workflow for the last few years has been the following:

• HTTP POST request with a login/password to get MLB.com credentials
• HTTP POST request with MLB.com credentials to get a JWT subject token
• HTTP POST request with JWT subject token to get access token
• Access token (periodically refreshed) can then presented to access streams

As of today, apparently, that sequence looks a lot different, so my app is broken, as is the Kodi plugin for MLB.tv. I've studied the new sequence a bit, and it's a lot more complicated. There's still an HTTP request with username/password to login with MLB, but there are several intermediate steps now. The first few are pretty easy to handle with standard requests stuff, and I can do the first Okta request for https://[mlb server]/oauth2/.../v1/authorize manually as well, but my thinking was that using a library to handle things would be more robust. That's what led me to discover your module.

I guess my question is this: when I submitted this issue, I didn't even realize that your module was routing the request through a local HTTP server. The reason I submitted the ticket is that when I initiate the Oauth request, it sends me to an MLB.com login page, then complains that the redirect_uri isn't in the allowed list. My guess is they're doing this to prevent exactly this sort of man-in-the-middle thing?

So, my confusion is this: your library is opening a web browser for the user to authenticate, but in my application, the user is already authenticated via username/password. The Okta stuff comes after that, so I don't see the need for (and wouldn't want) another web challenge where a user has to enter credentials. Is that something that would be possible?

Perhaps I can get under the hood a bit more with your module to try to answer these questions myself, but in the interest of getting something working, I'm probably going to try to just emulate the exchange manually for now. Any advice / experience you have with these protocols would be helpful in figuring out if this is the right tool for the job, or if I can contribute anything here.

[Colin-b]

Can I come back to you this weekend on this? This module was designed to ease those Auth flows, so your use case is legit. If there is no need for a user interaction to authenticate then it's possible this flow is not yet implemented but again I would like to look into it a bit myself as well in order to be able to properly respond to your requirements :-)

…

On Fri, Mar 29, 2019, 04:33 tonycpsu ***@***.***> wrote: Yeah, I can get your a PR for it, but I'm not quite sure my use case is legit, and I'm actually not quite certain this module is what I need for this application, so let me explain a bit. I've developed an application <https://github.com/tonycpsu/mlbstreamer/> for watching MLB.tv baseball games. The authentication workflow for the last few years has been the following: - HTTP POST request with a login/password to get MLB.com credentials - HTTP POST request with MLB.com credentials to get a JWT subject token - HTTP POST request with JWT subject token to get access token - Access token (periodically refreshed) can then presented to access streams As of today, apparently, that sequence looks a lot different, so my app is broken, as is the Kodi plugin for MLB.tv. I've studied the new sequence a bit, and it's a lot more complicated. There's still an HTTP request with username/password to login with MLB, but there are several intermediate steps now. The first few are pretty easy to handle with standard requests stuff, and I can do the first Okta request for https://[mlb server]/oauth2/.../v1/authorize manually as well, but my thinking was that using a library to handle things would be more robust. That's what led me to discover your module. I guess my question is this: when I submitted this issue, I didn't even realize that your module was routing the request through a local HTTP server. The reason I submitted the ticket is that when I initiate the Oauth request, it sends me to an MLB.com login page, then complains that the redirect_uri isn't in the allowed list. My guess is they're doing this to prevent exactly this sort of man-in-the-middle thing? So, my confusion is this: your library is opening a web browser for the user to authenticate, but in my application, the user is already authenticated via username/password. The Okta stuff comes after that, so I don't see the need for (and wouldn't want) another web challenge where a user has to enter credentials. Is that something that would be possible? Perhaps I can get under the hood a bit more with your module to try to answer these questions myself, but in the interest of getting something working, I'm probably going to try to just emulate the exchange manually for now. Any advice / experience you have with these protocols would be helpful in figuring out if this is the right tool for the job, or if I can contribute anything here. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#25 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AHPX_eeEKXMY-x6V98XTWJu_ZzLvlbI_ks5vbYmGgaJpZM4cRQ7h> .

[tonycpsu]

Can I come back to you this weekend on this?

Of course! Like I said, I'm probably going to hack something together for the short term, so there's no immediate need on my end.

[Colin-b]

I created an account but I cannot figure out how to login to a free MLB.tv subscription.
Do you have any input on this? (I can use a VPN if required as I am in Belgium)

Or if you already know the full workflow and describe it here I can provide some help :)

[tonycpsu]

Yeah, I did get it working. Here's the commit. There are.... a lot of steps. I'm not sure that all of them are required, and it looks like another project is doing things differently to achieve the same result. (I haven't tried that approach yet.)

[da1910]

There's a similar use case for enterprise OAuth where localhost redirects are usually disallowed - in these cases you normally lock down to a specific white-listed hostname.