Email or username:

Password:

Forgot your password?
All posts Sean's posts Post Back to profile
Sean Tilley
So... I'm developing this frontend. To set it up to make it work, I used my account to register an application, which gave me a client_id and a secret. I used those to get an access token, which I put into my app.

Then, I used that app to log in as myself with a password grant. So far, so good.

The thing that makes me kind of uncomfortable is the realization that I can see my timeline stuff when I'm logged out...which shouldn't be happening. I put a bullshit piece of login logic up to steer anonymous users from private statuses, but this seems wrong.

So, here's my question: did I accidentally scope my entire application to access everything a single authenticated user should access? If so, what do I need to do to make this properly multi-tenant? I feel like maybe I should somehow maybe save the resulting token a user gets after logging in to localstorage or something, and somehow make the API requests for an authenticated user access that?

#Mastodon #Pleroma #Fediverse
9 Feb 2021 at 0:12 | Open on social.deadsuperhero.com
8 comments
Darius Kazemi

@sean if I'm understanding you right, yes, the localstorage method is how I handle it

9 Feb 2021 at 0:12 | Open on friend.camp
charlag

@darius @sean in any case I would say store locally

9 Feb 2021 at 0:17 | Open on birb.site
Sean Tilley
@darius got it. So, it sounds like I should maybe update my API calls so that there are public and private versions. Public uses no bearer token, and is the default unless somebody is authenticated, at which point their localstorage token is used in the authenticated version of the call.

Thinking on it, maybe the calls can have some if-else logic to detect whether a user is logged in, so that I don't have to double-code everything. 😛
@darius got it. So, it sounds like I should maybe update my API calls so that there are public and private versions. Public uses no bearer token, and is the default unless somebody is authenticated, at which point their localstorage token is used in the authenticated version of the call.
9 Feb 2021 at 0:34 | Open on social.deadsuperhero.com
Darius Kazemi

@sean exactly the first thing you said. The if/else thing could work but it's unusual for an endpoint to give two different results (other than say 200 vs 401) when authenticated or not. Typically you would render a different view template if logged in that accesses a different set of endpoints.

9 Feb 2021 at 0:33 | Open on friend.camp
Darius Kazemi

@sean so you would have some api calls requiring a bearer token from localstorage, and some that work unauthenticated

9 Feb 2021 at 0:34 | Open on friend.camp
Sean Tilley
@darius cool, in a nutshell that's what I'm thinking of doing.

There seems to be some warning against storing tokens in the browser, so I'm exploring what other way this might be done securely. 😅
9 Feb 2021 at 0:42 | Open on social.deadsuperhero.com
Darius Kazemi

@sean what sort of warning? It's standard practice for OAuth

9 Feb 2021 at 0:42 | Open on friend.camp
Darius Kazemi

@sean some tokens should not be stored, but others are designed to be

9 Feb 2021 at 0:42 | Open on friend.camp
Go Up