Client creates a new token for each page load/refresh

[marten]

I'm not sure what's going on, but if you look at the Network requests you'll see a POST /oauth/token every time, which then generates a new token on the Panoptes side. Shouldn't the client, after login, stick the access token, refresh token and expiry time somewhere in a cookie/localstorage and keep using that?

[eatyourgreens]

Should be fixed by #75, which stores the token details in session storage. New windows or tabs will probably still issue token requests, because they don't share session storage.

[eatyourgreens]

Actually, reading this again, this might be a bug in auth.js rather than oauth.js.

[camallen]

Sticking the token in local storage could be an issue for shared computers, ideally a sign out event will clean this up combined with a check on expired tokens during page load, etc.

However we can certainly be smarter about token expiration and re-use than what we currently are. Specifically auth.js and oauth.js share common concerns around token lifecycle events but don't share any code. Ideally we should have different strategies:

1. credential flow current auth.js
2. implicit flow current oauth.js
   To get the token that then pass into a common token re-use and management with hooks to renew tokens, etc.

[eatyourgreens]

This is called from Auth.checkCurrent. I'm not 100% sure what current thing that is checking, but I think it's the current user.

panoptes-javascript-client/lib/auth.js

Lines 39 to 64 in 4ef31ec

	_getBearerToken: function() {
	console.log('Getting bearer token');
	if (this._bearerToken) {
	console.info('Already had a bearer token', this._bearerToken);
	return Promise.resolve(this._bearerToken);
	} else {
	var url = config.host + '/oauth/token';
	var data = {
	'grant_type': 'password',
	'client_id': config.clientAppID,
	};
	return makeHTTPRequest('POST', url, data, JSON_HEADERS)
	.then(function(request) {
	var token = this._handleNewBearerToken(request);
	console.info('Got bearer token', token.slice(-6));
	return token;
	}.bind(this))
	.catch(function(request) {
	// You're probably not signed in.
	console.error('Failed to get bearer token');
	return apiClient.handleError(request);
	});
	}
	},

[eatyourgreens]

Both credential flow (auth.js) and implicit flow (oauth.js) are legacy now and not recommended for use.

OAuth 2.1 doesn’t allow the credentials flow at all.