{"action":"created","issue":{"url":"https://api.github.com/repos/remotestorage/remotestorage.js/issues/893","labels_url":"https://api.github.com/repos/remotestorage/remotestorage.js/issues/893/labels{/name}","comments_url":"https://api.github.com/repos/remotestorage/remotestorage.js/issues/893/comments","events_url":"https://api.github.com/repos/remotestorage/remotestorage.js/issues/893/events","html_url":"https://github.com/remotestorage/remotestorage.js/issues/893","id":107408074,"number":893,"title":"Remove access token from browser history","user":{"login":"skddc","id":842,"avatar_url":"https://avatars.githubusercontent.com/u/842?v=3","gravatar_id":"","url":"https://api.github.com/users/skddc","html_url":"https://github.com/skddc","followers_url":"https://api.github.com/users/skddc/followers","following_url":"https://api.github.com/users/skddc/following{/other_user}","gists_url":"https://api.github.com/users/skddc/gists{/gist_id}","starred_url":"https://api.github.com/users/skddc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/skddc/subscriptions","organizations_url":"https://api.github.com/users/skddc/orgs","repos_url":"https://api.github.com/users/skddc/repos","events_url":"https://api.github.com/users/skddc/events{/privacy}","received_events_url":"https://api.github.com/users/skddc/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/remotestorage/remotestorage.js/labels/easy","name":"easy","color":"fbca04"},{"url":"https://api.github.com/repos/remotestorage/remotestorage.js/labels/help%20wanted","name":"help wanted","color":"bfe5bf"},{"url":"https://api.github.com/repos/remotestorage/remotestorage.js/labels/improvement","name":"improvement","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2015-09-20T18:10:55Z","updated_at":"2015-10-13T13:43:01Z","closed_at":null,"body":"... maybe just remove the whole OAuth callback URL entry.\r\n\r\nHere are some docs for the History API: https://developer.mozilla.org/en-US/docs/Web/API/History_API#Adding_and_modifying_history_entries (I'm actually not sure if this will delete the entry from the history database in all browsers, though)"},"comment":{"url":"https://api.github.com/repos/remotestorage/remotestorage.js/issues/comments/147717725","html_url":"https://github.com/remotestorage/remotestorage.js/issues/893#issuecomment-147717725","issue_url":"https://api.github.com/repos/remotestorage/remotestorage.js/issues/893","id":147717725,"user":{"login":"skddc","id":842,"avatar_url":"https://avatars.githubusercontent.com/u/842?v=3","gravatar_id":"","url":"https://api.github.com/users/skddc","html_url":"https://github.com/skddc","followers_url":"https://api.github.com/users/skddc/followers","following_url":"https://api.github.com/users/skddc/following{/other_user}","gists_url":"https://api.github.com/users/skddc/gists{/gist_id}","starred_url":"https://api.github.com/users/skddc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/skddc/subscriptions","organizations_url":"https://api.github.com/users/skddc/orgs","repos_url":"https://api.github.com/users/skddc/repos","events_url":"https://api.github.com/users/skddc/events{/privacy}","received_events_url":"https://api.github.com/users/skddc/received_events","type":"User","site_admin":false},"created_at":"2015-10-13T13:43:01Z","updated_at":"2015-10-13T13:43:01Z","body":"Oh wow, talk about individual experiences. :) In fact, I was talking about OAuth popups, as all sites I log into with e.g. Twitter or FB these days have switched to full-page redirects. I think the only thing left I know was Disqus, because it's run on arbitrary sites outside of their control.\r\n\r\nRegarding short-lived tokens, that's certainly something the user should be able to do. We do have it on our todo list for 5apps Storage (with dropdown for expiry from \"1 day\" to \"never\" or similar).\r\n\r\nI think it's still worth trying to remove them from the browser history, wherever possible. The first tests at least yielded a little bit of success in Chrome."}}