OAuth support

[CaptainN]

Hi!

What's involved with making oauth work (either oauth1, for which there is a WP API plugin plugin, or OAuth 2 for which there is a standalone plugin) with this plugin instead of standard HTTP authentication?

Kevin N.

[kadamwhite]

@CaptainN OAuth isn't currently supported by this library -- the basic process, if I understand it (and I'll be honest, I've never used OAuth successfully without confusion) is that you'd use the plugin to generate a key, then we'd need to add a facility to this API to make a request with that key to get the token used to authenticate.

It's definitely something I'd like to add, but I haven't had the time to get to it yet and adding media support (and more robustly supporting/testing against the WP-API 2.0 betas) are the priorities right now. If you've got OAuth experience, or interest, I'd love to get some help putting this in though

[mzalewski]

I doubt anyone has used OAuth without confusion :) I've managed to get OAuth working though, so I should be able to help out

[kadamwhite]

@mzalewski if you're interested, that would be excellent in the extreme!

[mzalewski]

Getting there slowly, I've got OAuth 1.0a working now. The only issue is that it requires user/browser authorization, so haven't quite figured out the best way to handle that. At the moment, I'm assuming that part will be done by the time the API is called so we already have an access token - but I have example code that does the actual authentication.

I'm planning to push it up tomorrow anyway so I'll let you know when it's up

[kadamwhite]

👍

[mzalewski]

I've added OAuth 1.0A support to my fork here:
https://github.com/mzalewski/wordpress-rest-api

I'm not 100% happy with it yet, but should hopefully give everyone a basic understanding of the direction I'm going. I've added some example code to the readme, so (hopefully) should be easy to understand if anyone wants to try it out

[kadamwhite]

Thanks, @mzalewski , I will check it out next week. I appreciate your sharing your efforts!

[kadamwhite]

I discussed the currently-supported OAuth flows with @rmccue today in slack; transcript below

• rmccue [7:35 PM] @kadamwhite: Go ahead and ask :simple_smile:
• kadamwhite [7:37 PM] @rmccue: :) Thanks. First off, is there any way, with the current oauth infrastructure, to have a completely server-side oauth process; i.e., without any need for the user to open a browser, assuming the app has previously had a key generated for it?
• rmccue [7:38 PM] Using OAuth, not really
  [7:38] That's typically called "one-legged" OAuth, and the way it works is by having a pre-authorised key/secret
  [7:38] Technically possible with the plugin, but you'd need to write an addon plugin to add UI for it
• kadamwhite [7:39 PM] hmm. ok. So there's not really any solution right now where a server-side app could authenticate with the wp-api, even if that app has previously been authorized and the user has entered their credentials into something accessible to the app — true?
  [7:39] I ask because the Initial outline #1 request i've gotten for the wp-api node client was oauth, but it sounds like that isn't really possible and that's frustrating.
• rmccue [7:42 PM] You could through an initial browser integration
  [7:42] If you have a look at the example client, that spits out the key/secret at the end of the process, so they could run that then just copy that across
  [7:43] But generally no, there's no server-server authentication right now
  [7:43] The #core-passwords team is working on "app passwords", which will help with that
  [7:44] http://oauth1.wp-api.org/docs/advanced/Desktop.html may also help
• kadamwhite [7:44 PM] how long-lived are the tokens?
• rmccue [7:47 PM](Sorry, was just making a ☕)
  [7:48] Currently, they do not expire
  [7:48] That might change in the future, but 1.0a doesn't have a "refresh" mechanism, so you'd need to re-auth from scratch
  [7:48] The plugin also currently doesn't recognise if a client has already been authorised, which might change
• kadamwhite [7:52 PM] > so you'd need to re-auth from scratch in the event that you lose the token, you mean? given that it won't expire on its own. I'm also uncertain about the nuance of "the plugin doesn't currently recognize if a client has already been authorized"
• rmccue [7:52 PM] If the plugin ​_did_​ expire tokens
• kadamwhite [7:52 PM] ah, i see
• rmccue [7:52 PM] Potentially could in the future, but the flow would suck
• kadamwhite [7:52 PM] nods
• rmccue [7:53 PM] And basically, when you send off an authorisation request to some OAuth providers, they'll tell you if you've already been given a token/secret for the user, and just give that back to you
  [7:53] The plugin currently doesn't do that, so you could end up with multiple tokens per user for the same app
• kadamwhite [7:54 PM] if they request more than one, you mean?
• rmccue [7:54 PM] That'll probably change, since there's no reason to do that
• kadamwhite [7:54 PM] if you re-use a token it should work?
• rmccue [7:54 PM] Yep
  [7:54] Some client apps do the lazy thing and don't store user state
  [7:54] They just reauthorise every time
• kadamwhite [7:55 PM] So, to recap: the best-case scenario for node-driven applications that wish to auth via oauth 1.0a would be,
  1. User creates an app secret etc using the oauth plugin's wp-admin screen under the "users" menu
  2. App requests authentication; user is required to open a browser in some capacity in order to enter their credentials, there is no way for any purely server-side logic to inject those into the process without user interaction
  3. Browser flow could end by displaying a token to the user that they can copy into their app's configuration file
  4. App could henceforth use that token to auth directly, just for that user
     missing anything?
• rmccue [7:56 PM] Nope, sounds right to me
• kadamwhite [7:56 PM] I'm glad to hear there's a group working on it because that's less than ideal, but I get how we're in this situation. Thanks for helping walk me through it.
• rmccue [7:56 PM] However, you ​_could_​ build a small plugin that essentially does 1-3 on the server
• kadamwhite [7:56 PM] howso…? thought you'd said that wasn't an option
• rmccue [7:56 PM] Essentially, it'd create the token and authorise it automatically
  [7:57] https://wordpress.slack.com/archives/core-restapi/p1453250332004937
• kadamwhite [7:57 PM] hmm, which server are we talking about, wp's or the app's?
• rmccue [7:57 PM] WP's
• kadamwhite [7:57 PM] ahh I misunderstood
• rmccue [7:57 PM] :simple_smile:
  [7:57] Yeah, should have said "provider" instead
• kadamwhite [7:57 PM] I'll probably want to pick your brain about that as well, then, because that would be of major benefit
• rmccue [7:57 PM] Indeed
• kadamwhite [7:58 PM] for now, we're ostensibly waiting for company to come over (I have my doubts), so I need to run. Thanks for your time, Ryan!

[mzalewski]

That server-side plugin sounds interesting, would you consider that?

oAuth 2.0 appears offer a few more options though - combined with the oAuth 2 plugin on WP.org (https://wp-oauth.com/knowledge-base/grant-types/), it might be possible to connect via oAuth without requiring a redirect.

[mzalewski]

What about simply exposing a way to hook into the Auth function and passing off authentication to third-party code/modules?

It could be the easiest option given the number of possible uses of this plugin (eg: web-based, desktop, library)

[kadamwhite]

Oauth support's the most common question we've gotten, so ideally I'd like to have something set up within the package itself. Lots of ways to move toward that, though! I finally reviewed the implementation you linked to, it's interesting -- could you walk me through the process of using it within your application's code?

[kadamwhite]

@mzalewski forgot to respond to the other part of your comment: I would 100% be interested in an add-on to provide https://wp-oauth.com/ compatibility for this client library, but I'm hesitant to implement support for a non-WP-native, paid plugin into the core wordpress-rest-api package. I feel it would be better to hold out for the core-passwords team's app passwords, or to investigate writing a companion WP plugin to extend the 1.0a server to give access to the node client in the way discussed in the chat above.

[mzalewski]

Fair enough - it definitely makes sense to support the official WP authentication methods out of the box.

I'm happy to walk through my fork, but it's been a pretty busy week - I'll free up some time to go through it properly within the next 1-2 days

I'll give a basic overview (from memory):
I've put most of the oAuth handling code into the oAuth1.js file, with some changes to WP-Request.js which passes URL signing off to the oAuth object.

Both Client ID and Client Secret are required parameters and are configured in WP. These, along with the oAuth URLs provided by the API, are used to construct an OAuth object ( new WP.OAuth )

oauth.getAuthorizeUrl

Sends a request WP API and receives a "request" token which is used to sign the Authorize URL (URL provided to promise callback).

User Redirect

The User is then required to log in on the site at the provided URL

oauth.getAccessToken

The getAccessToken function can then be used by passing the OAuth Token and verification code. This function is responsible for sending the access/verify tokens to the server, and finally receiving an authenticated token.

Once we have that authenticated token, it is stored for future use and will be used to authenticate outgoing requests.

It uses the OAuth Node (node-oauth) library behind the scenes, so the documentation there may help - the code I've written simply wraps node-oauth and attempts to integrate it into your functions.

Hopefully that helps understand what I've done.

I also came across this while working on it: http://passportjs.org/ - It doesn't solve any of the issues around redirecting users, but from what I can tell it is a popular library for working with oAuth and could possibly save a lot of time?

[mzalewski]

Sorry if it's confusing, even I am having trouble reading what I've just written.
I'll see if I can put together a diagram which should explain things more clearly

[kadamwhite]

@mzalewski no problem whatsoever, I appreciate it. I'm going to have some concerted time to work on this in conjunction with the WP-API team at the feelingrestful.com event next week, so if you get a chance to go through it in more detail by Wednesday or so that'd be very helpful; but as time permits this weekend or on the flight I'll take what you've given me already and see what I can make of it!

Thanks a ton.