Comments (6)
@lyschoening Did you try the Google connect on https://play.authlib.org/ ? Which works pretty well.
Besides, that state
is recommended to be included in authorization request according to RFC:
https://tools.ietf.org/html/rfc6749#section-4.1.1
from authlib.
@lepture Is https://play.authlib.org/ a Flask app/sending the state parameter?
I'm authorizing through https://accounts.google.com/o/oauth2/token, not https://www.googleapis.com/oauth2/v4/token, which could explain why the behavior is different.
Google's documentation does not mention a state parameter
https://developers.google.com/identity/protocols/OAuth2WebServer#exchange-authorization-code and from reading around it seems this is known non-standard behavior in Google's API.
from authlib.
I should add that state
isn't the only parameter being forwarded. Every parameter on the callback response is forwarded (authuser
, session_state
, prompt
in this case).
from authlib.
@lyschoening Is there any reason that you have to use https://accounts.google.com/o/oauth2/token
instead of https://www.googleapis.com/oauth2/v4/token
I'm ok to change the default behavior of request.args.to_dict(flat=True)
. But state
will always be included, I don't think https://accounts.google.com/o/oauth2/token
has done OAuth 2 right.
from authlib.
@lepture It's the URL in the configuration the Google Cloud console returns when you create an OAuth client for a web application.
from authlib.
@lyschoening I've cleaned up params in authorize_access_token
.
Here is the endpoints that I found for Google: https://accounts.google.com/.well-known/openid-configuration
from authlib.
Related Issues (20)
- rfc7519 JsonWebEncryption is initialized with an incorrect list of algorhythms.
- Incorrect check for insecure transport on OAuth1.0
- Have special character encoding be optional
- Quoting (URL-encoding) Base authentication username / password is incorrect HOT 1
- JWT authentication issue HOT 3
- Allow to disable expired token auto-refresh
- Need to be able to add headers when calling authorize_redirect() HOT 2
- do not have refresh token HOT 2
- JWTClaims accepts True/False `iat`.
- Too slow to generate id token with RSA HOT 1
- Token refresh failed when using AsyncOAuth2Client with client credentials
- getting no client id from vk.com oauth HOT 1
- Change token in session HOT 2
- Algorithm confusion when verifying JSON Web Tokens with asymmetric public keys HOT 5
- Support for plain code_challenge_method HOT 4
- Why self.form.get('grant_type') and not self.data.get('grant_type') ? HOT 10
- New token will not be fetched if grant_type='client_credentials' is passed for fetch_token()
- Unpinned Dependency on cryptography Breaks Installation Due to Rust Requirement HOT 1
- Python 3.12 support
- EdDSA fails to decrypt JWTs
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from authlib.