{"action":"created","issue":{"url":"https://api.github.com/repos/meteor/meteor/issues/4441","labels_url":"https://api.github.com/repos/meteor/meteor/issues/4441/labels{/name}","comments_url":"https://api.github.com/repos/meteor/meteor/issues/4441/comments","events_url":"https://api.github.com/repos/meteor/meteor/issues/4441/events","html_url":"https://github.com/meteor/meteor/issues/4441","id":79883125,"number":4441,"title":"OAuth over DDP with an accessToken (namely Facebook SDK on iOS)","user":{"login":"smothers","id":124385,"avatar_url":"https://avatars.githubusercontent.com/u/124385?v=3","gravatar_id":"","url":"https://api.github.com/users/smothers","html_url":"https://github.com/smothers","followers_url":"https://api.github.com/users/smothers/followers","following_url":"https://api.github.com/users/smothers/following{/other_user}","gists_url":"https://api.github.com/users/smothers/gists{/gist_id}","starred_url":"https://api.github.com/users/smothers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smothers/subscriptions","organizations_url":"https://api.github.com/users/smothers/orgs","repos_url":"https://api.github.com/users/smothers/repos","events_url":"https://api.github.com/users/smothers/events{/privacy}","received_events_url":"https://api.github.com/users/smothers/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/meteor/meteor/labels/Project:Accounts:OAuth","name":"Project:Accounts:OAuth","color":"c7def8"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-05-23T15:59:03Z","updated_at":"2015-05-27T16:55:32Z","closed_at":null,"body":"Much of the current OAuth flow seems to be [tied to the browser](https://github.com/meteor/meteor/blob/devel/packages/oauth/pending_credentials.js). \r\n\r\nIt requires a mixture of [HTTP and parsing HTML](https://github.com/jasper-lu/android-ddp-client/blob/master/src/com/keysolutions/ddpclient/android/DDPStateSingleton.java#L376), [DDP](https://github.com/jasper-lu/android-ddp-client/blob/master/src/com/keysolutions/ddpclient/android/DDPStateSingleton.java#L391) and [modifications to the oauth packages](https://github.com/jasper-lu/accounts-facebook-ddp) to get them to work with the Facebook SDK on iOS.\r\n\r\n-----\r\n\r\n**What if the DDP login method accepted the accessToken returned from the Facebook SDK and just worked?**\r\n```javascript\r\nDDPClient.call(\"login\", { oauth: { accessToken: \"auth token returned by native sdk\", service: \"facebook\" } })\r\n```\r\n\r\n-----\r\n\r\nHere's the current approach:\r\n\r\n1. Start by changing accounts-facebook to accounts-facebook-ddp. This will [recognize valid accessTokens](https://github.com/jasper-lu/facebook-ddp/blob/master/facebook_server.js#L56) instead of just trying to request new ones.\r\n```javascript\r\n// 1b. Login with Facebook SDK and get credentials for user\r\nvar credentials = WhatTheFacebookLoginMethodReturns\r\n\r\n// 2. Prime meteor's pending_credentials collection with the access token and get a \"credentialSecret\" by pretending to be a popup\r\nvar expiresIn = (new Date(credentials.tokenExpirationDate)).getTime() - (new Date).getTime();\r\nvar state = that._generateState(\"popup\", credentials.token)\r\nvar meteorFacebookOauthUrl = \"http://localhost:3000/_oauth/facebook/?accessToken=\"+credentials.token+\"&expiresIn=\"+expiresIn+\"&state=\"+state;\r\nfetch(meteorFacebookOauthUrl).then(function(response){\r\n  \r\n  // 3. Parse the response HTML for the credentialSecret\r\n  var re = new RegExp(\"<div id=\\\"config\\\" style=\\\"display:none;\\\">(.*?)</div>\")\r\n  var found = re.exec(response._bodyText)\r\n  var config = JSON.parse(found[1])\r\n\r\n  // 4. Login over DDP\r\n  var loginOptions = {\r\n    oauth: {\r\n      credentialToken: credentials.token,\r\n      credentialSecret: config.credentialSecret\r\n    }\r\n  };\r\n  ddpClient.call(\"login\", [loginOptions], function(err, result) {\r\n    console.log(\"err: \", err, \" result: \", result);\r\n  });\r\n});\r\n\r\n_generateState = function (loginStyle, credentialToken, redirectUrl) {\r\n  return new Buffer(JSON.stringify({\r\n    loginStyle: loginStyle,\r\n    credentialToken: credentialToken,\r\n    redirectUrl: redirectUrl})).toString('base64');\r\n};\r\n```\r\n\r\nThis is how the Android and Objective-C DDP packages handle native OAuth and it's what I've been using with React-Native.\r\n\r\n#3515 addresses some of the problem, but the final solution involves decoupling OAuth from the browser.\r\n"},"comment":{"url":"https://api.github.com/repos/meteor/meteor/issues/comments/105992639","html_url":"https://github.com/meteor/meteor/issues/4441#issuecomment-105992639","issue_url":"https://api.github.com/repos/meteor/meteor/issues/4441","id":105992639,"user":{"login":"smothers","id":124385,"avatar_url":"https://avatars.githubusercontent.com/u/124385?v=3","gravatar_id":"","url":"https://api.github.com/users/smothers","html_url":"https://github.com/smothers","followers_url":"https://api.github.com/users/smothers/followers","following_url":"https://api.github.com/users/smothers/following{/other_user}","gists_url":"https://api.github.com/users/smothers/gists{/gist_id}","starred_url":"https://api.github.com/users/smothers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smothers/subscriptions","organizations_url":"https://api.github.com/users/smothers/orgs","repos_url":"https://api.github.com/users/smothers/repos","events_url":"https://api.github.com/users/smothers/events{/privacy}","received_events_url":"https://api.github.com/users/smothers/received_events","type":"User","site_admin":false},"created_at":"2015-05-27T16:55:32Z","updated_at":"2015-05-27T16:55:32Z","body":"Does this answers your question? https://developers.facebook.com/docs/facebook-login/access-tokens#architecture\r\n\r\nUsing `appsecret_proof` to secure a Graph API requests made from the meteor server with a token generated in a native client looks like exactly what we want. Use that to make the first request from meteor for the user's profile information."}}