Support logging in with OAuth2. - #6835
Conversation
| const val AUTHORIZATION_ENDPOINT = "/w/rest.php/oauth2/authorize" | ||
| const val TOKEN_ENDPOINT = "/w/rest.php/oauth2/access_token" | ||
| const val PROFILE_ENDPOINT = "/w/rest.php/oauth2/resource/profile" | ||
| const val LOGOUT_ENDPOINT = "/w/rest.php/oauth2/logout" // <--TODO? |
There was a problem hiding this comment.
/w/api.php?action=logout&global=1 (we can add a REST API equivalent if you feel strongly about it)
|
|
||
| companion object { | ||
| const val CLIENT_ID = "50ad79ffa34f64853c96b729e4aa5d8c" | ||
| const val REDIRECT_URI = "wikipedia://oauth/callback" |
There was a problem hiding this comment.
Note that you need to use a HTTPS URI to be able to make use if T423609.
| companion object { | ||
| const val CLIENT_ID = "50ad79ffa34f64853c96b729e4aa5d8c" | ||
| const val REDIRECT_URI = "wikipedia://oauth/callback" | ||
| const val OAUTH_WIKI = "https://meta.wikimedia.org" // TODO: use current language wiki? |
There was a problem hiding this comment.
Probably best to use the current language wiki. As long as you set the uselang parameter, it won't make a lot of difference, but there are some things in the login/signup forms (even in their minimal, no-skin view) that the wiki community can customize, e.g. the enwiki signup form has an extra link to the username policy.
| } | ||
|
|
||
| // TODO: figure out how and when to orchestrate refreshing of tokens. | ||
| // Currently blocked on https://phabricator.wikimedia.org/T323855 |
There was a problem hiding this comment.
That has been fixed. You should either keep track of token expiry and use a refresh token if it's expired, or listen for the response header signalling expiry (per RFC 6750) and retry failed requests. The first approach is probably less hassle, and also not at risk of server-side bugs (with HAProxy, the API Gateway and MediaWiki each doing some form of bearer token parsing, there is a good chance something somewhere won't fail the correct way for an expired token).
2 participants
A minimal prototype of the app logging in via OAuth2 (using our testing OAuth2 consumer on metawiki).
https://phabricator.wikimedia.org/T395459