oauth | OAuth 2.0 Authorization Server | OAuth library

Edited (I missed the part where you fallback on TryGetFormCredentials)

It seems like you need to send the form data as application/x-www-form-urlencoded. See the RFC

After unnecessary searches for logic solutions i find that in form_params block client_id has a space caracter before parenthesis.

Try to read this document: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#offline_access.

This permission currently appears on all consent pages, even for flows that don't provide a refresh token (such as the implicit flow). This setup addresses scenarios where a client can begin within the implicit flow and then move to the code flow where a refresh token is expected.

On the Microsoft identity platform (requests made to the v2.0 endpoint), your app must explicitly request the offline_access scope, to receive refresh tokens.

It’s not currently possible to remove the offline_access scope from the initial consent screen when using the v2 endpoint with an AAD account. There is a feedback of this issue here.

You are correct that someone with access to the client_id and client_secret - and some dedication - could potentially access the resources. Do note that it also requires obtaining an authorization code from the user, which requires phishing or some other kind of - not too difficult - attack on the side. But basically impersonating the client when you have the client credentials is easy.

To prevent that, you can use techniques that are used elsewhere for keeping secrets out of the hands of rogue developers, such as:

• rotate the client secret regularly
• change the client secret explicitly on certain events, e.g. when someone leaves or a leak was detected
• use a PKI solution for client authentication (such as private_key_jwt) which does not require any changes on the Provider side to rollover the client's certificate/key, thus making the first two approaches easier (in case the client cert/key is compromised)
• use different secrets in production that in development environments and shield the secrets in production environments from people that should not have access
• etc.

I needed to send mails from a gmail account that I have access to, using nodemailer. It works for a couple of days before my refresh token is mysteriously revoked, even though the account belongs to me. A google search brought me here and I had been watching for a while hoping someone would help with a solution.

As you mentioned, this seems to happen with only test/unverified apps and I'm guessing google revokes tokens for such applications in your account after a few days. After much trials and errors, here is what I did.

NOTE: This is solution is only applicable to accounts you own, otherwise you must verify your app to access other people's accounts

1. Generate a new refresh token (existing one is most likely revoked) as described in this SO post
2. Go to the security tab of your google account dashboard
3. Under the Recent security activity section, you should see a security alert for your app.
4. Click on the context menu next to the notification and click DISMISS
5. At this point you'll be presented with a dialog of options where you indicate the level of trust you have for the app. I just went ahead and said I trusted the developer/app, obviously. And that's it! The refresh token should persist after this.

I could not find anything related anywhere else. So, please, accept this answer if it works for you. It might help someone else

From ADP's public documentation:

In general, your consumer application should pass the client_id and client_secret parameters in the HTTP Authorization header using the HTTP Basic authentication scheme (or other designated scheme). The client_id and client_secret must be separated by a single colon (":") character and encoded within a base64-encoded string, as required by IETF RFC 2617.

Your consumer application must:

• Send the request with the X.509 certificate provided during registration.
• Pass all parameters in a URL-encoded format with UTF-8 character encoding as specified by the HTTP header Content-Type: application/x-www-form-urlencoded. The actual request might look like the following example:

The problem here is you're keeping the token in the state, and once you update the state in the middle of the function, the value is not updated synchronously, thus you're still getting an empty array. I would rephrase your useEffect with an async/await syntax like so:

To improve compile-time type safety, package:http 0.13.0 introduced breaking changes that made all functions that previously accepted Uris or Strings now accept only Uris instead. You will need to explicitly use Uri.parse to create Uris from Strings. (package:http formerly called that internally for you.)

(and so on.)

In your specific example, you will need to use:

Have you enabled deep-linking on Android? https://reactnative.dev/docs/linking