{"action":"opened","issue":{"url":"https://api.github.com/repos/frol/flask-restplus-server-example/issues/115","repository_url":"https://api.github.com/repos/frol/flask-restplus-server-example","labels_url":"https://api.github.com/repos/frol/flask-restplus-server-example/issues/115/labels{/name}","comments_url":"https://api.github.com/repos/frol/flask-restplus-server-example/issues/115/comments","events_url":"https://api.github.com/repos/frol/flask-restplus-server-example/issues/115/events","html_url":"https://github.com/frol/flask-restplus-server-example/issues/115","id":325120009,"number":115,"title":"Could you explain comment on authorization endpoint - this implementation is broken...","user":{"login":"bitfinity","id":209595,"avatar_url":"https://avatars2.githubusercontent.com/u/209595?v=4","gravatar_id":"","url":"https://api.github.com/users/bitfinity","html_url":"https://github.com/bitfinity","followers_url":"https://api.github.com/users/bitfinity/followers","following_url":"https://api.github.com/users/bitfinity/following{/other_user}","gists_url":"https://api.github.com/users/bitfinity/gists{/gist_id}","starred_url":"https://api.github.com/users/bitfinity/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bitfinity/subscriptions","organizations_url":"https://api.github.com/users/bitfinity/orgs","repos_url":"https://api.github.com/users/bitfinity/repos","events_url":"https://api.github.com/users/bitfinity/events{/privacy}","received_events_url":"https://api.github.com/users/bitfinity/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-05-22T02:33:13Z","updated_at":"2018-05-22T02:33:13Z","closed_at":null,"author_association":"NONE","body":"\r\n```\r\n    # TODO: improve implementation. This implementation is broken because we\r\n    # don't use cookies, so there is no session which client could carry on.\r\n    # OAuth2 server should probably be deployed on a separate domain, so we\r\n    # can implement a login page and store cookies with a session id.\r\n    # ALTERNATIVELY, authorize page can be implemented as SPA (single page\r\n    # application)\r\n```\r\nI thought the whole point of oauth was to allow login without cookies and it seems that once you authorize (which seems to be to allow access to the documentation via the web browser), future requests are passed the authorization token in bearer?\r\n\r\nSo my use case is that I have a REST service being accessed via a react web-app which is obviously mostly javascript single page. I want to give the REST client the ability to grant tokens to users based on their usernames and passwords - i.e. the rest javascript client will be an oauth client which will give grant access to future requests made by itself on behalf of the user it is representing.\r\n\r\nIf I'm just going to use cookies and sessions, it seems like the oauth is overkill. Am I missing something?\r\n"}}
{"actor":{"display_login":"bitfinity"}}