After digging manually through the configuration classes I was able to find and add the following, which did the trick… security.oauth2.client.pre-established-redirect-uri=https://[application_host]/login security.oauth2.client.registered-redirect-uri=https://[application_host]/login security.oauth2.client.use-current-uri=false I’m not convinced there isn’t a better way to solve the problem of forcing a HTTPS redirect URL, but this fix worked for me.
Mobile apps, at least on iOS and Android, can register custom URL schemes so that a redirect from a browser can send the user back to your app along with some query parameters. So, you can use these flows in a native mobile app, but it involves sending the user to a web browser (either … Read more
To perform GET requests with URL query string: import requests params = { ‘action’: ‘subscribe’, ‘callbackurl’: ”, ‘comment’: ”, ‘oauth_consumer_key’: ”, ‘oauth_nonce’: ”, # more key=value pairs as appeared in your query string } r = requests.get(“http://wbsapi.withings.net/notify”, params=params) With that cleared, now you just need to follow the workflow documented on http://www.withings.com/en/api/oauthguide and implement them … Read more
Client Secret was used in OAuth 1.0 to sign the request, so it was required. Some OAuth2 servers (such as Google Web Server API) required the client secret to be sent to receive the access token (either from request token or refresh token). OAuth 2.0 has reduced the role of the client secret significantly, but … Read more
Short answer A JWT is a convenient way to encode and verify claims. A Bearer Token is just a string, potentially arbitrary, that is used for authorization. Context (story time) A few years ago, before the JWT revolution, a <token> was just a string with no intrinsic meaning, e.g. 2pWS6RQmdZpE0TQ93X. That token was then looked-up … Read more
I’ve been puzzled by the same question about lack of domain or app url, but it turns out redirection is not the only possible way to complete OAuth authentication process. I.e., when webapp requests access it provides callback url: the one user will be redirected to when process is completed. That’s how webapp know that … Read more
There is no need for you to create custom headers or authentication schemes at all. The Bearer authentication scheme is designed exactly for your use case: Authorization: Bearer e1d9753f-a508-46cc-a428-1787595d63e4 Basic authentication must be as follows: Authorization: Basic base64EncodedUsernameAndPassword where base64EncodedUsernameAndPassword is equal to the output of: base_64_encode(username + ‘:’ + raw_password) Do not use Basic … Read more
I found the solution. call login() with backend argument like login(request, user, backend=’django.contrib.auth.backends.ModelBackend’) here is full code: def activate(request, uidb64, token, backend=’django.contrib.auth.backends.ModelBackend’): try: uid = force_text(urlsafe_base64_decode(uidb64)) user = User.objects.get(pk=uid) except (TypeError, ValueError, OverflowError, User.DoesNotExist): user = None if user is not None and account_activation_token.check_token(user, token): user.is_active = True user.profile.email_confirmed = True user.save() login(request, user, backend=’django.contrib.auth.backends.ModelBackend’) … Read more
Almost all oauth examples on blogs seem to be examples of the authorisation phase of oauth and none focus on how to actually make requests once you have these, as once you understand how it works this part is quite obvious. Getting that initial understanding is quite difficult unfortunately. If you’re just trying access your … Read more