Comments (3)
Thanks for the comments here!
I've captured your first point in #28 -- this is a bug introduced in a recent contribution and we should fix it.
Re: communicating a client id, it's true that the OAuth spec allows it to appear optionally; the SMART spec says something more specific, since it's a profile on OAuth designed to ensure more consistent behavior:
Hope this makes sense!
Re: typescript, we aren't currently working on this but would love contributions in this direction. (Overall, it's getting to be time for a ground-up rewrite...)
from client-js.
Thanks for the quick answer and for opening the issue!
To the client_id
:
Our server is designed for "public apps". He is more like an EPR than an EHR, where the patients can store personal health-related data from third party apps (like Smartphone apps) and share the data for clinical trials. Therefore, the client id will never be optional.
Now the OAuth sever expects the client_id
to be always in the request body and not only when no client_secret
is set. Atm. most of these developed "public apps" have a secret.
With the doc part above the table you've posted, I now know, that we should not send / define client_secrets
for such public apps. So as far as I understand, we should deactivate / delete the secrets of these apps.
Do I understand this correctly?
TypeScript: I'll send you a PM next week for some discussion and contributions on this point.
from client-js.
It's correct that if you're only supporting public apps, then there should be no client_secret
s involved.
from client-js.
Related Issues (20)
- Typo in README
- Unable to get patientId after successful login HOT 1
- (Error handling skipped on init) CompleteAuth not triggered for init HOT 1
- includeResponse not working for FHIR update operations
- "target: popup" (etc) demos don't work in current Chromium HOT 2
- Single SMART_KEY breaks authorization of several users on server-side
- Jest + RTL :: Testing with FHIRClient
- Uncaught (in promise) Error: Failed to fetch the conformance statement from "https://staging-fhir.ecwcloud.com/fhir/r4/FFBJCD/metadata". TypeError: Network request failed HOT 6
- Question: Smart-On-Fhir implementation inside Service Worker
- FHIR type Meta requiring lastUpdated property when spec allows it to be optional
- Node js After 10 min 401 unauthorized response HOT 4
- Window closes itself when it's not actually a popup
- Save token info in DB
- Support of PKCE even when the EHR .well-known configuration is not set? HOT 2
- Assumption on patient id in context
- Improve or rename "Contributing and Development" section in README
- Zombie `changelog.md` file in the project's root.
- npm audit report semver vulnerability
- Cannot specify custom aud parameter and FHIR server URL
- FHIR.oauth2.authorize not redirecting to my authorization server if the app is hosted on the production server HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from client-js.