{"action":"created","issue":{"url":"https://api.github.com/repos/SpoonX/aurelia-authentication/issues/1","repository_url":"https://api.github.com/repos/SpoonX/aurelia-authentication","labels_url":"https://api.github.com/repos/SpoonX/aurelia-authentication/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/SpoonX/aurelia-authentication/issues/1/comments","events_url":"https://api.github.com/repos/SpoonX/aurelia-authentication/issues/1/events","html_url":"https://github.com/SpoonX/aurelia-authentication/issues/1","id":122939319,"number":1,"title":"Implement refresh token","user":{"login":"RWOverdijk","id":781745,"avatar_url":"https://avatars.githubusercontent.com/u/781745?v=3","gravatar_id":"","url":"https://api.github.com/users/RWOverdijk","html_url":"https://github.com/RWOverdijk","followers_url":"https://api.github.com/users/RWOverdijk/followers","following_url":"https://api.github.com/users/RWOverdijk/following{/other_user}","gists_url":"https://api.github.com/users/RWOverdijk/gists{/gist_id}","starred_url":"https://api.github.com/users/RWOverdijk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RWOverdijk/subscriptions","organizations_url":"https://api.github.com/users/RWOverdijk/orgs","repos_url":"https://api.github.com/users/RWOverdijk/repos","events_url":"https://api.github.com/users/RWOverdijk/events{/privacy}","received_events_url":"https://api.github.com/users/RWOverdijk/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":20,"created_at":"2015-12-18T12:18:05Z","updated_at":"2016-07-01T10:26:28Z","closed_at":"2016-04-04T15:24:49Z","body":"https://gist.github.com/vuorinem/6b57225915e00920e3b1"},"comment":{"url":"https://api.github.com/repos/SpoonX/aurelia-authentication/issues/comments/229913540","html_url":"https://github.com/SpoonX/aurelia-authentication/issues/1#issuecomment-229913540","issue_url":"https://api.github.com/repos/SpoonX/aurelia-authentication/issues/1","id":229913540,"user":{"login":"doktordirk","id":13430091,"avatar_url":"https://avatars.githubusercontent.com/u/13430091?v=3","gravatar_id":"","url":"https://api.github.com/users/doktordirk","html_url":"https://github.com/doktordirk","followers_url":"https://api.github.com/users/doktordirk/followers","following_url":"https://api.github.com/users/doktordirk/following{/other_user}","gists_url":"https://api.github.com/users/doktordirk/gists{/gist_id}","starred_url":"https://api.github.com/users/doktordirk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/doktordirk/subscriptions","organizations_url":"https://api.github.com/users/doktordirk/orgs","repos_url":"https://api.github.com/users/doktordirk/repos","events_url":"https://api.github.com/users/doktordirk/events{/privacy}","received_events_url":"https://api.github.com/users/doktordirk/received_events","type":"User","site_admin":false},"created_at":"2016-07-01T10:26:28Z","updated_at":"2016-07-01T10:26:28Z","body":"well, to conclude this, we as well as aurelia-auth as well as satellizer do the same:\r\n\r\n1 open popup with eg `https://www.facebook.com/v2.5/dialog/oauth?client_id=937004143046787&display=popup&redirect_uri=http%3A%2F%2Flocalhost%3A9000%2F&response_type=code&scope=email`\r\n2 in the popup, the user logs into facebook (the authenication provider)\r\n3 on sucess, facebook redirects the popup to eg `http://localhost:9000/?code=***lengthy_code***g#_=_`\r\n4 the popup closes and aurelia-auth gets the code from the redirect query string\r\n5 the code is send to the own authorization server \r\n6 the server uses the code and sends it together with the client secret (only the authorization server has that) to facebook to validate the identity\r\n7 facebook confirms by sending back the facebock access-token to the authorization server\r\n8 the authorization server can request more info from facebook, eg email and profile\r\n9 the authorization server creates it's own jwt (wihich has nothing to do with the facebook access token. that's only on the authorization server) and sends it's own newly created jwt back the client\r\n10 the client can use the jwt to access the own api server (that api server has no knowledge about facebook. that's only on the authorization server. hence the api server also can access facebook directly neither)\r\n11 the client can use a refresh_token to get from the authorization server a new own jwt for the web server (no facebook involved here)\r\n12 the client might request facebook data by sending a request to the authorization server. the authorization server then can request that info from facebook and send it back to the client\r\n\r\nyou see, while the (alone useless) code from facebook is exposed to the user-agent, at no time the client has access to the facebook client secret or the facebook access token. that's always on the server only. all requests to facebook (other then login), have to be done via the authorization server, as only he has the access code and the client secret to do so\r\n\r\ni hope, your concerns are addressed with that clarification. if you have trouble to find above steps in the code, please tell me. i'll can point you to them\r\n\r\n\r\n"}}
{"actor":{"display_login":"doktordirk"}}