Does this library support user approval dialog during authorization code grant?

[saschanaz]

It seems AuthenticationHandler is to see who the user is from the request, not to show an additional dialog for explicit approval. Is it a supported flow?

[jankapunkt]

This is implementation detail, the allowed flag is set by client implementation and indicates approval if true or denied of false.

[saschanaz]

It indeed is implementation detail, but I see no way to:

1. Call authorize() (in a route handler)
2. After parameter validation, show an (implementation detail) prompt for the user
3. Redirect when the user approves

[saschanaz]

node-oauth2-server/lib/handlers/authorize-handler.js

Lines 98 to 100 in c993eb5

	if (request.query.allowed === 'false' || request.body.allowed === 'false') {
	throw new AccessDeniedError('Access denied: user denied access to application');
	}

I feel like the library expects the client to access the authorization endpoint after having approval from the user somehow, is that correct?

[jankapunkt]

@saschanaz it's the second to third step in the Authorization Code Grant workflow: https://datatracker.ietf.org/doc/html/rfc6749.html#section-4.1 see Part B)

[saschanaz]

Yes I want to do that, but how can implement that using this library? oauth2orize for example allows rendering a page after the parameter verification with a transaction ID (https://github.com/jaredhanson/oauth2orize#implement-authorization-endpoint).

Edit: to be more specific:

(B) The authorization server authenticates the resource owner (via
the user-agent) and establishes whether the resource owner
grants or denies the client's access request.

For this step, in many cases the server renders a page for user with buttons to grant/deny, or login if not yet. I don't immediately see such step in this library, to render an (implementation detail) page before granting code. AFAICT this library just proceeds to grant, doesn't it?

[jankapunkt]

@saschanaz do you use express? We could create a minimal example project with express + vanilla JavaScript + in memory DB that shows how this could work. We have an examples repo under https://github.com/node-oauth/node-oauth2-server-examples and this would be a perfect example. What do you think?

[saschanaz]

I use Fastify but can use fastify-express if needed. Yes, an example would be great.

[jankapunkt]

@saschanaz I added you as collaborator to the examples repo and created a branch there incl. draft PR: node-oauth/node-oauth2-server-examples#1

Let's continue discussion here: node-oauth/node-oauth2-server-examples#2

[jfstephe]

I had/am having similar issues. I can't believe this is so difficult to get going (that is not a criticism of the project maintainers, just a comment on the project itself).

After hours digging into the source code I found I needed to implement:

....authorize({
  authenticateHandler: {
    handle: function(req, res) {
      // get authenticated user or return falsy value, e.g.:
      return req.session.user;
    }
  }

taken from oauthjs/node-oauth2-server#314

A good, and complete, example would be a great first step though.

To the maintainers: Thanks for keeping this project alive and doing what you do! 👍

[saschanaz]

Is it related to showing the dialog page during the authorization process, though? It's only to extract the user info from the request, right?

[jfstephe]

Well yeah sort of... I was trying to work out how to get the auth code. You can't get an auth code without having an authorised user (I'm still working through this so if this isn't 100% please correct me). If you don't override that function an exception will be thrown as it expects a token to be present.... ...but there can't be a token as you are trying to access this resource for the first time (as per the related issue in the original oauthjs project).

[saschanaz]

but there can't be a token as you are trying to access this resource for the first time (as per the related issue in the original oauthjs project).

Exactly, and it should be perfectly fine to not have a token since the client may be a native app and the browser may not have any user info yet when opening oauth/authorize endpoint.

[jankapunkt]

@saschanaz @jfstephe just to clarify: we are all talking about the authorization code grant workflow here, right?

[saschanaz]

Yes, and see https://datatracker.ietf.org/doc/html/rfc8252#section-4.1 for example (as IMO it's clearer than the one in https://datatracker.ietf.org/doc/html/rfc6749.html#section-4.1).

(1) Client app opens a browser tab with the authorization request.

(2) Authorization endpoint receives the authorization request,
authenticates the user, and obtains authorization.
Authenticating the user may involve chaining to other
authentication systems.

A client in the step 1 will, for example, open https://host.example/oauth/authorize?... via a web browser. And this request should be validated and then render something in the browser to show accept/reject buttons. So far I see no way, and oauth-example skips the whole validation and goes straight to show the form, which seems wrong to me.

https://datatracker.ietf.org/doc/html/rfc6749.html#section-4.1.1

The authorization server validates the request to ensure that all
required parameters are present and valid. If the request is valid,
the authorization server authenticates the resource owner and obtains
an authorization decision (by asking the resource owner or by
establishing approval via other means).

Validate and then obtain the decision, not the other way around, right?