We Keep Coding

How to implement token based authentication in oauth2.0 process

Below is my understanding of the process of oauth2.0(using google as the oauth2.0 server)
my customer click 'login with google account' button on client side.
the browser redirect to google's login page.
my customer inputs it's credential and click 'login'.
if my customer succeeded in previous step,the browser will redirect to my server's url
(www.[myserver].com/auth/google/callback) with some extra query
data.
then my server will do some work to get some token from google and finally get my customer's information.
My question comes from the next step. I want to use token based authentication.Then I have to make my customer to store my own token in localStorage. I can't figure out how to achieve this in the 6th step(how to send a new token to client side and store it in localStorage?).
(I know that every thing will be easy if I am using cookie-based authentication. because I can just utilize 'set-cookie' in the 6th step, and the client side will be easily store the credential data in client side's cookie)

Google APIs use the OAuth 2.0 protocol for authentication and authorization. Google supports common OAuth 2.0 scenarios such as those for web server, installed, and client-side applications.

I figure out that I can use some type of template engine on my server side(just like discussed here). So I can render my template file using variable before send it to my customer.

How to authenticate user in browser using AWS Cognito?

I need to authenticate users in browser (not mobile app) using AWS Cognito with username/pass, not FB/google IdProviders.
There are a lot of docs but they seem to be separate blocks which either incomplete, do not fit the requirements or do not fit each others :(
I created Cognito User Pool, then Identity pool and tied the userPool to the idPool, then I stuck. Do not know which library to use and how to use it.
The closest I find are:
https://aws.amazon.com/sdk-for-browser/ but my experience is not enough to convert their FB samples to not-using FB
https://github.com/aws/aws-amplify but using this lib I'll have to study React/Angular from the very beginning (I'm not a front-end developer, sorry) and I have no clue how to convert their npm-based samples to front-end javascript (npm is for NodeJS thus back-end, isn't it?).
All I need is plain html form with username/pass, send the request to Cognito and a way to check during the next page load whether the password was correct. If it matters I will use AWS Lambda as back-end for processing future tasks.
How can I do it? Is there a tutorial/doc for my case?
Thank you.

You can use AWS Cognito UserPools Hosted UI for your use case. The simplest form of authentication is using the Implicit Grant.
For more information about setting up Hosted UI refer Add an App to Enable the Hosted Web UI.. This will create a UserPool where users can register them self (If you plan to restrict this, you will need to either add users using the AWS Web Console, Cognito UserPools or using their SDK)
The steps are as follows.
Set up Cognito Hosted UI and register your application domain. This will create the login/registration pages for you where each of this will have a unique URL. What you have to do is, if the user is not authenticated (Let's discuss how to detect it later), you need to redirect the user to the Login page.
In the Login URL, you also need to specify the redirect back URL to the application so that after a successful login, Cognito will redirect back the user to the application providing the token in a query string.
You can then access the id_token from inside the application and use it for querying the backend.
Since the id_token is a JWT token you can verify it at your Backend using the public key available at the Cognito token endpoint.
To implement the JWT verification, you can also refer Cognito JWT Token validator NodeJS module.
Note: If you need to keep the user's logged in for a longer time period (Than 1 hr), you might need to use the Code Grant flow which will return a Refresh Token, which could be used to retrieve new id_tokens programmatically.

Use Google Drive API from Javascript

I want to extend a project in a way that it can save files to Google Drive. To learn how this works I tried the Quick Start Example from the docs: https://developers.google.com/drive/v3/web/quickstart/js
Following the example I noticed that the example is creating an API key in the developer console. Following the same steps only returns a Client secret. I suspected this to be a naming problem and hoped that the two are the same.
Unfortunately, the example code does not work but loggs the following error:
{"error":{"errors":[{"domain":"usageLimits","reason":"keyInvalid","message":"Bad Request"}],"code":400,"message":"Bad Request"}}
In the request to:
https://content.googleapis.com/discovery/v1/apis/drive/v3/rest?pp=0&fields=kind%2Cname%2Cversion%2CrootUrl%2CservicePath%2Cresources%2Cparameters%2Cmethods%2CbatchPath%2Cid&key=[[my key]]
I checked that the right secret appears in the request url. Setting var API_KEY = '<YOUR_API_KEY>'; to an empty string is a workaround.
How can I debug this further? where do i get the right api key?

I run into this error recently. It is certain that Google Documentation is usually quite good, but in this case, the Google Drive API (https://developers.google.com/drive/api/v3/quickstart/js) it wasn't that clear. For this API in particular, you will require two credentials.
Under your project credentials section, you must create an OAuth 2.0 client for a web application and a API Key.
(Sorry for the Spanish in the screenshots)
Regarding the OAuth 2.0 client, not that I have restricted it to http://localhost
Concerning the API Key, note that I have restricted it to my Google Drive API
Then, in the index.html provided by the documentation, you can set your CLIENT_ID to the one obtained in the OAuth 2.0 client generation, and the API_KEY to the the one generated in the API Key process.

{"error":{"errors":[{"domain":"usageLimits","reason":"keyInvalid","message":"Bad Request"}],"code":400,"message":"Bad Request"}}
Means that the request you have made has not been properly authenticated.
API key is for accessing public data. Oauth2 client id and secret will be used to access private user data which file.list is. So i dont think this is a naming problem. Your code should be popping up requesting access of the user.

Using node package outside of node app

I'm making a chrome extension that uses Firebase database. For their custom authentication I need to create a JWT token to have the user sign in.
I saw on their documentation that their is a function to generate these tokens in node using the function call:
var customToken = firebase.auth().createCustomToken(uid);
My issue is that my chrome extension is not a node app, so I don't have access to this function. I have the firebase auth API from their CDN but when I try using that function I get firebase.auth(...).createCustomToken is not a function.
I guess that the create JWT token function is just for node.js firebase users. Is there a way I can still get access to this token generator without my extension being a node app?
I'm new to this JWT stuff so really I'm just looking for an easy way to generate one of these tokens somehow.

Creating a custom token requires access to the service account of your Firebase project. This is a server-side secret and should never be present in the clients that access your project. If you give your clients the secret needed to mint a custom token, you're giving them full access to your project. You might as well not use authentication in that case.
The typical approach is to run a server that mints a custom token based on your app's needs and then use that token in your client (e.g. a chrome extension) to sign in.
Alternatively you can use one of the built-in authentication methods, such as email+password, Facebook, Google or even anonymous sign-in.

How to access Facebook public data from client-side without compromising app secret

I'm trying to build a JavaScript metro app that pulls Facebook public data (posts from Home Depot for example) through their Graph API. It seems that an access token is always required to interact with the Graph API.
In order to obtain an access token, both the App ID and Secrets needs to be sent to the Facebook OAuth endpoint. This makes sense for server-side code but not for client-side, since the app secret cannot be shipped with client code that can be easily unpackaged/decomplied/intercepted.
So my questions are:
Is there a way to access the Graph API (public data) without using access tokens?
Is there a way to obtain an access token without sending over the App Secret?
Is there a replacement to the offline_access token?
Please keep in mind that:
I only need to access PUBLIC data.
NO user login is needed.
Thanks!

No
One option is to have the user log in and get an access token for them that way. Another would be to have your own server provide a token creation service, so the secret would not need to be in the app binary.
You can exchange a token to a longer-lived 60 day token https://developers.facebook.com/docs/facebook-login/access-tokens/#extending