I want to get the Authorization code to generate ACCESS TOKEN and REFRESH TOKEN for my Application. I'm trying to get the job done using POSTMAN. But this seems not working. I'm attaching a screenshot of POSTMAN. Can you tell me what I am doing wrong?
Any useful suggestion or alternative solution is appreciated.
https://www.postman.com/praveendvd-public/workspace/postman-tricks-and-tips/documentation/8296678-5dc51f3f-c7b0-4c66-a457-11af32bb1a63?entity=request-6dda15f2-306b-4915-a585-
use this public collection as an example
It will be easier to do this using settings within the Postman GUI. There is an Authorization tab in which you can specify auth type, configure new tokens, add your client id & secret, etc.
After many tries, I figured it out myself. To Generate the Refresh token and access token the first time, I needed Authorization Code. I thought I need to generate it again and again but it Turns out I needed it only once and when I got the access_token and refresh_token, I can easily generate access_token by using refresh_token.
Here's the corrected API request flow-
Requesting Authorization code
Using Web
Requesting ACCESS TOKEN and REFRESH TOKEN
Regenerating Access Token using refresh token
Related
I cannot replicate the example regarding the authentication with JWT using graphql and provided in the tutorial https://www.howtographql.com/graphql-python/4-authentication/. The "me" query does always fails cause we get the value AnonymousUser from info.context.user instead of the authenticated user by the JWT token in the http header.
Did anyone face this problem before?
Many thanks in advance,
I'm thinking of a proper pattern for implementing refresh tokens, but on few steps, I have some questions. I am using nextjs with axios on the frontend and express with cookie-session on the backend.
Here are steps I'm thinking of:
Client sends a log-in request. After logging in I put the access token in the session object and the refresh token into res.cookie, both secure and httpOnly.
// for simplicity options are left out
req.session = { accessToken };
res.cookie("refreshToken", refreshToken)
On every request with axios I supply just the access token. Here's where the first question arises. How would I supply only the access token, without sending the refresh token too, if both are httpOnly?
If the access token is valid do whatever is needed. If not, need to get the refresh token and compare it to a stored one, and so on. Here's the second question. While I understand I need to retrieve the refresh token in this step, how would I do it properly?
Any more advice would be great, thanks.
[EDIT] After some thought I realised that making access token not httpOnly would allow me to send just access token, which would solve my problem. But if that is incorrect please let me know.
Here is the standard pattern - as in this code of mine:
Client sends access token (which may be in an HTTP Only cookie)
When it expires they try to refresh the access token by calling a /refresh endpoint
If the refresh succeeds they retry the API request with the new access token
Otherwise the client redirects the user to sign in again
Don't make the access token non HTTP Only, since any malicious code could then grab it from document.cookie.
This also allows you to set a path of /refresh for the RT cookie, so that it is only sent on refresh requests.
Also ensure that cookies containing tokens are strongly encrypted (AES256) using a symmetric key only known server side. This Express library will do the work for you.
So I generated access token and access token secret on Twitter
However's every time I make a GET request on Postman I get bad authentication data:
I copy & paste the access token after "Basic" in the Value so I don't know why it's not working?? I would be so grateful if anyone helped!!!
PS I didn't put anything in the authorization tab on Postman. Not sure if that's relevant:
You should be getting GET not POST for statuses/user_timeline as per Twitter API User Timeline
GET statuses/user_timeline
I have searched a lot but I can't find the right answer.
I'm working with the Spotify Web API. The access token is only valid for 1 hour. I want to know if it's possible to renew the Spotify access token automatically? And if the answer is yes, how can I do that?
Thanks
Better solution what was find is: Login use Authorization Code Flow
you will receive access_token and refresh_token - and when access_token expired you can get new use refresh_token as describe in '7. Requesting access token from refresh token'
I would like to use google fusion tables, for which I need to login first.
I do a http request and get the "auth" token as response.
But now I stuck and don't know how to use this token?
I could neither find any google docs on this nor this thread helped: Google Auth using Token
Because adding the auth token to the url does not work.
You use the authorization code to get an access_token.
This has useful information:
https://developers.google.com/usiontables/docs/articles/oauthfusiontables
You then send the access_token with your sql query.