companion: change oauth access token transport method #1668
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
to check my understanding, this is for communication between Companion and the OAuth login endpoint? |
Contributor
Author
technically, yes. But this is actually used between 2 companion endpoints. One endpoint (this endpoint is in the grant library) receives the token from the OAuth provider, and it passes it to our own So grant can either pass it down to us via query param, or session. |
Contributor
|
Goootcha. that clears it up, thanks for the explanation ✨ |
goto-bus-stop
approved these changes
Jun 16, 2019
HeavenFox
pushed a commit
to docsend/uppy
that referenced
this pull request
Jun 27, 2023
companion: change oauth access token transport method
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
this change prevents us from exposing the provider access_tokens in URLs which could be access in logs or browser history