implement bearer token authentication #15

Manually merged

Johann150 merged 5 commits from bearer-authentication into main

2022-07-20 13:11:43 +00:00

Johann150 commented

2022-07-18 21:33:11 +00:00

Owner

Bearer token authentication is implemented on the back end. This should eventually help with problems brought up in #14 (but the client also needs to be adjusted).

Since we already basically used bearer tokens this is not really tricky, it just has to be put into/taken from the right fields & formats for OAuth 2.0.

Bearer token authentication is implemented on the back end. This should eventually help with problems brought up in #14 (but the client also needs to be adjusted). Since we already basically used bearer tokens this is not really tricky, it just has to be put into/taken from the right fields & formats for OAuth 2.0.

Johann150 added 4 commits 2022-07-18 21:33:12 +00:00

add OAuth 2.0 Bearer Token authentication 91bdab1a9d

improve authentication errors edac21e8f7

update openapi spec generator 660f6dba30

handle authentication errors in stream API ff75382af3

Johann150 added this to the (deleted) project 2022-07-18 21:33:24 +00:00

Johann150 added a new dependency 2022-07-18 21:34:41 +00:00

#14 hide metadata of private notes

Johann150 added 1 commit 2022-07-18 22:50:01 +00:00

client: use bearer token authorization fddf3573a1

ente commented

2022-07-19 05:28:49 +00:00

First-time contributor

Does this break compatibility with the Misskey API?

As far as I understand it, this is just a different keyword in the JSON to mark the token, so I can just pass it in two different flavours to be compatible with Misskey and Foundkey?

{
"i": "token",
"Bearer": "token"
}

Does this break compatibility with the Misskey API? As far as I understand it, this is just a different keyword in the JSON to mark the token, so I can just pass it in two different flavours to be compatible with Misskey and Foundkey? ``` { "i": "token", "Bearer": "token" } ```

Johann150 commented

2022-07-19 06:06:57 +00:00

Author

Owner

This is not a breaking change. (yet?)

You are not quite right, the alternative way to pass in the token is via the HTTP Header Authorization in the format Bearer <token> (where <token> is what you put in i). This is a standardized mechanism from OAuth 2.0 called Bearer Token Authentication.

Note that passing in the token both ways is forbidden by the OAuth specification and will cause an error.

This is not a breaking change. (yet?) You are not quite right, the alternative way to pass in the token is via the HTTP Header `Authorization` in the format `Bearer <token>` (where `<token>` is what you put in `i`). This is a standardized mechanism from OAuth 2.0 called Bearer Token Authentication. Note that passing in the token both ways is forbidden by the OAuth specification and will cause an error.

Johann150 commented

2022-07-19 07:47:48 +00:00

Author

Owner

Also made a pull request to add this to Misskey: https://github.com/misskey-dev/misskey/pull/9021