{"action":"closed","issue":{"url":"https://api.github.com/repos/jaredhanson/oauth2orize/issues/157","repository_url":"https://api.github.com/repos/jaredhanson/oauth2orize","labels_url":"https://api.github.com/repos/jaredhanson/oauth2orize/issues/157/labels{/name}","comments_url":"https://api.github.com/repos/jaredhanson/oauth2orize/issues/157/comments","events_url":"https://api.github.com/repos/jaredhanson/oauth2orize/issues/157/events","html_url":"https://github.com/jaredhanson/oauth2orize/issues/157","id":132196943,"number":157,"title":"Proper way of \"rememberMe\" option","user":{"login":"gsikorski","id":10234673,"avatar_url":"https://avatars.githubusercontent.com/u/10234673?v=3","gravatar_id":"","url":"https://api.github.com/users/gsikorski","html_url":"https://github.com/gsikorski","followers_url":"https://api.github.com/users/gsikorski/followers","following_url":"https://api.github.com/users/gsikorski/following{/other_user}","gists_url":"https://api.github.com/users/gsikorski/gists{/gist_id}","starred_url":"https://api.github.com/users/gsikorski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gsikorski/subscriptions","organizations_url":"https://api.github.com/users/gsikorski/orgs","repos_url":"https://api.github.com/users/gsikorski/repos","events_url":"https://api.github.com/users/gsikorski/events{/privacy}","received_events_url":"https://api.github.com/users/gsikorski/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-02-08T16:54:42Z","updated_at":"2016-02-22T16:12:18Z","closed_at":"2016-02-22T16:12:18Z","body":"I am trying to implement `rememberMe` checkbox on decision dialog. What I want to achieve is to allow user to store `allow` decision per client. I have it eventually working, although I am not quite sure if the implementation is proper. Could you advice please?\r\n```js\r\nexports.authorization = [\r\n    server.authorization((clientId, redirectUri, callback) => {\r\n        clients.findOne({\r\n            id: clientId\r\n        }, (err, client) => {\r\n            if (err) {\r\n                console.log(err);\r\n                callback(null, false);\r\n            } else {\r\n                // todo - confirm redirectUri\r\n                callback(null, client, redirectUri);\r\n            }\r\n        });\r\n    }, (client, user, done) => {\r\n        let trustedClients = user && user.trustedClients || [];\r\n        if (trustedClients.indexOf(client.id) >= 0) {\r\n            return done(null, true);\r\n        }\r\n        return done(null, false);\r\n    }),\r\n    (req, res) => {\r\n        return res.render('dialog', {\r\n            transactionId: req.oauth2.transactionID,\r\n            user: req.user,\r\n            client: req.oauth2.client.name\r\n        });\r\n    }\r\n];\r\n\r\nexports.decision = [\r\n    server.decision((req, done) => {\r\n        if (req.body && !req.body.cancel // <= This bit bothers me\r\n            && req.body.rememberMe) {\r\n            users.findById(req.user.id, (err, user) => {\r\n                user.trustedClients = user.trustedClients || [];\r\n                if (user.trustedClients.indexOf(req.oauth2.client.id) < 0) {\r\n                    user.trustedClients.push(req.oauth2.client.id);\r\n                    user.save(done);\r\n                } else {\r\n                    done()\r\n                }\r\n            });\r\n        } else {\r\n            done();\r\n        }\r\n    })\r\n];\r\n```\r\n\r\nThe only concern I have with this solution is it is a bit ugly that I need to verify user's decision in the `parse` callback, since this is somehow code duplication of the `server.decision` function. Also, correct me if I am wrong, I am opening the security hole here, because I am storing the decision without verification of the `transaction_id`, so in order to make it fully secure I would also need to add comparison of cookie value with the one in the request body. This all looks to me somehow like a hacking, not \"proper\" design, but could not make it working other way..."}}