Questions tagged [doorkeeper]
Doorkeeper is an OAuth 2 provider for Rails.
301
questions
0
votes
1
answer
10
views
Doorkeeper 5.4.0 ArgumentError
I recently updated my app, from doorkeeper 5.3.3 to 5.4.0 but changes to Doorkeeper::AccessToken.find_or_create_for were made apparently, but I can't find anything in the CHANGELOG
so
@access_token = ...
1
vote
1
answer
15
views
Secure Action cable with Doorkeeper Authorisation
I am working on ActionCable and implemented Doorkeeper Authorization in my rails application.
I want to implement authenticate my client with Doorkeeper::AccessToken with ActionCable
Here is how I ...
0
votes
0
answers
20
views
Possible to see the structure or Doorkeeper AccessGrant?
I've been using Doorkeeper in a Ruby app and I have an AccessGrant (AccessCode) which is being exchanged for an AccessToken in an OIDC flow
Given I am using the default encoders/decoders, I am ...
1
vote
1
answer
35
views
Overriding Doorkeeper refresh token response
I am trying to also send the user details in the refresh token response using Doorkeeper (I am using it on API only). I tried calling the Doorkeeper::TokensController#create method in one of my other ...
0
votes
0
answers
105
views
client_credentials flow using doorkeeper + rails + doorkeeper JWT, How to authenticate the flow
I have an application that uses both the flows client_credentials and authorization_code.
Initially we were only following the authorization_code grant flow and created a doorkeeper strategy to handle ...
1
vote
1
answer
243
views
How to implement a custom_access_token_expires_in method with Doorkeeper?
I have a rails 7 application with its own api. I am using Doorkeeper gem to implement authorizing external parties to be able to use the API.
So far I have gotten the Doorkeeper gem working with the ...
0
votes
0
answers
38
views
Doorkeeper Refresh Token & Polymorphic association
Is it the expected behaviour not to populate the column resource_owner_type on token refresh grant?
The original token gets correctly associated to the resource owner (both id & type columns), but ...
1
vote
0
answers
318
views
Rails 7 secure API by API key
I'm still fresh in Rails so that question might be trivial.
Rails app explanation
Rails 7
Ruby 3.1.2
Devise (API and web)
I've got Rails 7 app which is a single page dashboard app with Devise to ...
0
votes
1
answer
108
views
Scope and Namespace routes in Rails
I'm following a tutorial on Dookeeper and Devise gems in Rails, in one point of the video, the author creates the following routes:
namespace :api do
namespace :v1 do
resources:books
end
end
...
0
votes
1
answer
190
views
error unsupported_grant_type with Doorkeeper device Authorization Request flow
When I send the access token request (polling) I receive the error: "unsupported_grant_type" (see as follows).
Note: this is the second request in the device flow, the first request works. ...
0
votes
1
answer
41
views
Doorkeeper token revoke callback
I'd like to invoke some code that requires the request object and the user when a token is revoked. It appears that Doorkeeper does not have the configuration to hook into the token revocation process....
1
vote
0
answers
159
views
Doorkeeper OpenID Connect and user federation with 3rd party IdP
There is an OpenID Connect extension for DoorKeeper - https://github.com/doorkeeper-gem/doorkeeper-openid_connect Thanks to that DoorKeeper may act like an SSO provider. Is it possible to organize a ...
0
votes
0
answers
100
views
Doorkeeper with MFA support
I am using Doorkeeper OAuth 2 for Rails and would like to add MFA support. For example, to be able to additionally ask users to confirm their login via Google Authenticator or, for example, via SMS. I ...
0
votes
1
answer
685
views
How to implement PKCE OAuth2 with React and Doorkeeper?
I created a Rails app with Devise and Doorkeeper for authentication to be used as an API with OAuth2 PKCE for a React Native app.
Expected behavior:
Return the authentication token when I send a POST ...
1
vote
0
answers
158
views
Communicate two Ruby on Rails app SSO for talk each other
We are working on a RoR platform compound by 3 applications.
An OAuth Server implemented with doorkeeper and devise just for login (users, emails, password, etc...). And two other RoR apps, let's ...
0
votes
1
answer
387
views
Doorkeeper OAuth application table is necessary for authorization?
I'm trying to add the Doorkeeper plus devise with google and facebook user authorization on API!
I followed this post https://www.vic-l.com/jwt-with-refresh-token-using-devise-and-doorkeeper-without-...
2
votes
0
answers
225
views
How to handle OAuth flow with Doorkeeper and Devise with PKCE flow?
Similar to How to handle OAuth flow with Doorkeeper in API Mode? but with PKCE flow. As it is not recommended to store client secrets on a front-end application, how can my front-end application (...
0
votes
1
answer
328
views
Doorkeeper gem redirecting to application's home page
I am following the video here: http://railscasts.com/episodes/353-oauth-with-doorkeeper
In this video it has you type something like localhost:3000/oauth/authorize
all works per the video except that ...
1
vote
1
answer
197
views
Should non-confidential client applications be allowed to use the OAuth 2.0 Client Credentials flow?
According to The OAuth 2.0 Authorization Framework, when obtaining authorization via the Client Credentials Grant flow, it says:
"The client credentials grant type MUST only be used by ...
1
vote
0
answers
313
views
How do you correctly store an httponly cookie containing a refresh token in the client?
I have been reading up on the topic of securing an API using doorkeeper. For the most part it has been pretty straight forward to set up the access token, refresh token pair. The issue I am currently ...
0
votes
1
answer
196
views
Rails Devise:Doorkeeper: Authentication, updating fields (devise)
How can I update the devise fields when doorkeeper is used as authorization provider using oauth.
My Authenticate method looks like this using Devise.
def authenticate(email, password)
user = User....
0
votes
1
answer
455
views
Use refresh token grant type but keep existing refresh token
Using the Doorkeeper Ruby gem, I would like to get a new access token by sending a POST to /oauth/tokens with the body
{ grant_type: :refresh_token, refresh_token: 'abc123', scope: :A }
I do not want ...
1
vote
1
answer
616
views
How to use JWT as refresh tokens with Doorkeeper?
I've been trying to find a guide to implement an auth API in Rails 6 that uses JWT+Refresh tokens, and consumes it with a React client that doesn't save the tokens in localStorage but in memory (...
0
votes
1
answer
520
views
Why am I receiving 401 Unauthorized errors with my Doorkeeper configuration?
I have a Rails 6.1 app using devise 4.7.1, doorkeeper 5.5.1, and devise-doorkeeper 1.2.0.
I'm trying to run through a (PKCE) OAuth flow, but the final step -- a POST request to /oauth/token -- returns ...
1
vote
0
answers
515
views
Is it very dangerous to expose client_secret of Doorkeeper applications in Front End?
My question is if it is very dangerous to have the client_secret in front end (React / React Native), because in all api endpoints generated by doorkeeper you have to put a client_id and client_secret....
2
votes
1
answer
627
views
Doorkeeper JWT without storing the whole jwt in database
We have an OAuth server that uses doorkeeper. We want to start using doorkeeper JWT, but we can't turn it on for all OAuth clients yet as some are out of our control and we are pretty sure they are ...
1
vote
0
answers
74
views
How do I stop doorkeeper from redirecting, and instead show me the oauth/authorize view?
I'm currently working on an integration in our application for IFTTT. I've got doorkeeper set up and authorizing.
I'm running into an issue where when the user hits the oauth/authorize route, ...
2
votes
1
answer
1k
views
Implementing social login for Rails Api-only app
I'm struggling to find a working method to implement oauth2 login via Facebook & Google for my existing api-only rails app. Login flow & jwt management is done with Devise & Doorkeeper, ...
0
votes
1
answer
906
views
For doorkeeper gem, why do we need to set redirect_url at both server dashboard and request param from client?
I'm looking at some examples about doorkeeper gem. One thing I noticed is they set redirect url at 2 places. One is when they create a new oauth application at /oauth/applications, the other is when ...
7
votes
3
answers
5k
views
Do we really need client_secret to get access_token on PKCE flow?
I am building 2 apps; a front-end, and a back-end.
The back-end will be built using Rails API + Doorkeeper Gem (oauth2 provider) while the front-end will be built using React Native.
Currently, I am ...
1
vote
1
answer
224
views
React compatible JS OAuth Client - Rails Doorkeeper
Has anyone successfully implemented OAuth using Doorkeeper as Provider [Authorization Code grant type] in React ? what package did you used that acted as omniauth [if you are using RaIls]
1
vote
1
answer
938
views
Rails: Doorkeeper custom response from context
We are using Doorkeeper gem to authenticate our users through an API. Everything is working fine since we've implemented it few years ago, we are using the password grant flow as in the example:
...
3
votes
1
answer
742
views
How to handle OAuth flow with Doorkeeper in API Mode?
The scenario is simple:
A Rails API-only server with a Doorkeeper provider
A mobile app and a SPA (let's say React) with users that want to be registered and logged in using email and password
When ...
0
votes
1
answer
235
views
JSON API Rails 6 with Devise - SignUp Problems
When i try to use the sign_up method of Devise, i get an internal server error but, after create the user.
My application.rb:
class ApplicationController < ActionController::Base
...
1
vote
0
answers
358
views
Setting up DoorKeeper with multiple Rails/React applications?
I've built multiple Rails/React applications for my company (all in one using Rails 6. Rails renders json to React).
All applications will be on the same domain and eventually, access rights will be ...
2
votes
2
answers
903
views
Invalid access_token when using RSpec request specs to authorize a request
I'm trying to test CredentialsController, which works fine in production, using RSpec request specs.
Code
Controller
class CredentialsController < ApplicationController
before_action :...
1
vote
2
answers
2k
views
RSpec: Stub controller method in request spec
I'm writing an RSpec request spec, which looks roughly like (somewhat shortened for brevity):
describe 'Items', type: :request do
describe 'GET /items' do
before do
allow_any_instance_of(...
0
votes
1
answer
344
views
Have latest Doorkeeper return 401 for unauthorized (reinstate old behaviour)
In the upgrade docs there's a note about the default response status moving from 401 to 400 (https://github.com/doorkeeper-gem/doorkeeper/wiki/Migration-from-old-versions#api-changes-2).
This is ...
0
votes
1
answer
696
views
I have an Rails APP API with Doorkeeper OAuth2 client_credentials. How to get bearer token information within the controller?
I have an Rails APP API with Doorkeeper OAuth2 client_credentials. I want to get the token information within the controller and get the uid of the user who consumed the bearer token and send a logger....
2
votes
1
answer
557
views
Enable PKCE with Doorkeeper
I am trying to enable PKCE with doorkeeper. I've followed the instructions here:
https://github.com/doorkeeper-gem/doorkeeper/wiki/Using-PKCE-flow
Which is basically just run:
bundle exec rails ...
1
vote
0
answers
95
views
Rails - Devise & Doorkeeper OAuth2 how to add a line in body (post request)
I'm a new guy trying to learn and catch up on Rails, I was able to make devise and doorkeeper work on my end. Question is, Is it possible to add a new parameter on my post request body? What I would ...
1
vote
1
answer
498
views
NoMethodError (undefined method `id' for nil:NilClass): at /oauth/authorize with doorkeeper
I am working on making my API an Oauth provider using Doorkeeper, when I make a request to /oauth/authorize, I get the error
NoMethodError (undefined method `id' for nil:NilClass):
After digging ...
6
votes
1
answer
3k
views
Doorkeeper Refresh Tokens Not Expiring on Reuse
I'm using Doorkeeper 5.2.1 and Ive consulted the Doorkeeper docs on refresh tokens and have read through several GitHub issues and pull requests related to refresh tokens, notably here and here.
From ...
3
votes
2
answers
3k
views
Missing required parameter: scope. after doorkeeper gem upgrade from 5.1.0 to 5.2.1
After a gem upgrade of doorkeeper from 5.1.0 to 5.2.1 on the Rails (5.2.3) application that provides authorization, the login for the application requesting authorization does not work anymore. The ...
0
votes
1
answer
199
views
Is it possible to make Doorkeeper to ignore basic auth
I am trying to protect my swagger with Basic Auth. But also, the Doorkeeper with Bearer authentication is used.
If I send the basic and bearer in one query, doorkeeper doesn't authorize me.
Is it ...
1
vote
0
answers
253
views
How previous_refresh_token column in Doorkeeper gem works?
# If there is a previous_refresh_token column,
# refresh tokens will be revoked after a related access token is used.
# If there is no previous_refresh_token column,
# previous tokens are ...
1
vote
1
answer
3k
views
How do I create a new application when using Doorkeeper and Rails in api_only mode?
I have a rails 5 api_only app and I'm adding doorkeeper as an Oauth2 provider, also in api_only mode.
When I have api_only mode, I have the following routes added for doorkeeper:
...
-1
votes
1
answer
348
views
CSRF Protection with doorkeeper authorization rails
I have a question which i can't seem to figure out from all the googling. I am building a rails app basically an api app. When i give out post request it returns me with an error '...
0
votes
0
answers
512
views
Uninitialized constant CustomTokenResponse(NameError) and Unauthorized Access for Valid Token
I have been trying to migrate my rails app to api and i just installed doorkeeper gem for authentication and it generates me a token for a valid user. Now i have two problems
It shows unauthorized ...
0
votes
1
answer
200
views
Can we block or restrict any access token in doorkeeper?
I am new to using doorkeeper gem.I am using this gem to provide authentication to my rails app for API's. For every request we need access token to process that request. Is there any method or feature ...