Expirations #57

New issue

Closed

opened 2026-03-03 16:45:16 +03:00 by kerem · 3 comments

kerem commented

2026-03-03 16:45:16 +03:00

Owner

Originally created by @stevejabs-unikey on GitHub (Aug 2, 2015).
Original GitHub issue: https://github.com/OAuthSwift/OAuthSwift/issues/89

Have a few questions regarding some additional features:

1.) LinkedIn, among many networks, don't support custom url schemes that are not http or https. Right now I have hacked in some support for localhost in both my custom web view controller and in the OAuthSwift2 class to support localhost redirect_uri's. I noticed that you have a heroku app setup to assist you for that. Any chance you'll build support directly into this library?

2.) Facebook and Google seem to be doing their own custom versions of OAuth2. Any chance for support for either? Like my first question, I'm in the process of hacking in Google support. The main reason why I'd like to see support here is so that I can add multiple accounts of each to my app. Both right now in their SDKs only support one account.

3.) Will there be any future support for token expiration notification and requesting new tokens when they near their expiration dates?

Originally created by @stevejabs-unikey on GitHub (Aug 2, 2015). Original GitHub issue: https://github.com/OAuthSwift/OAuthSwift/issues/89 Have a few questions regarding some additional features: 1.) LinkedIn, among many networks, don't support custom url schemes that are not http or https. Right now I have hacked in some support for localhost in both my custom web view controller and in the OAuthSwift2 class to support localhost redirect_uri's. I noticed that you have a heroku app setup to assist you for that. Any chance you'll build support directly into this library? 2.) Facebook and Google seem to be doing their own custom versions of OAuth2. Any chance for support for either? Like my first question, I'm in the process of hacking in Google support. The main reason why I'd like to see support here is so that I can add multiple accounts of each to my app. Both right now in their SDKs only support one account. 3.) Will there be any future support for token expiration notification and requesting new tokens when they near their expiration dates?

kerem

2026-03-03 16:45:16 +03:00

closed this issue
added the
enhancement

question
labels

kerem commented

2026-03-03 16:45:18 +03:00

Author

Owner

@phimage commented on GitHub (Aug 8, 2015):

owner of project could have better answer but I can add some info

1/ you do the good job by hacking the web view

I think for security reason you must not use http(s) website provided by a framework like heroku that is not your own website
Owner of the website can keep all oauth token
Wiki page

have a link on api? do you study the difference? have error messages?

for facebook I find in python some compliance hook
https://coveralls.io/files/822595316

3/ a) revoking token
there is RFC but not always followed
https://tools.ietf.org/html/rfc7009

POST /applications/:client_id/tokens/:access_token
POST https://api.twitter.com/oauth2/invalidate_token with access_token:access_token
POST /revoke   with token=:access_token
DELETE  /api/users/<user id>/access_token/<refresh token>

So need an revoke url and the attribute name

b) refresh token
http://tools.ietf.org/html/rfc6749#section-1.5
http://tools.ietf.org/html/rfc6749#section-6
http://tools.ietf.org/html/rfc6749#section-10.4

POST xxx/refresh?refresh_token=XXX&client_id=YYY&grant_type=refresh_token&client_secret ...

expiration currently must be handled by you in failure callback, and reconnect then

@phimage commented on GitHub (Aug 8, 2015): owner of project could have better answer but I can add some info 1/ you do the good job by hacking the web view I think for security reason you must not use http(s) website provided by a framework like heroku that is not your own website Owner of the website can keep all oauth token [Wiki page](https://github.com/dongri/OAuthSwift/wiki/API-with-only-HTTP-scheme-into-callback-URL) 2) have a link on api? do you study the difference? have error messages? for facebook I find in python some compliance hook https://coveralls.io/files/822595316 3/ a) revoking token there is RFC but not always followed https://tools.ietf.org/html/rfc7009 ``` POST /applications/:client_id/tokens/:access_token POST https://api.twitter.com/oauth2/invalidate_token with access_token:access_token POST /revoke with token=:access_token DELETE /api/users/<user id>/access_token/<refresh token> ``` So need an revoke url and the attribute name b) refresh token http://tools.ietf.org/html/rfc6749#section-1.5 http://tools.ietf.org/html/rfc6749#section-6 http://tools.ietf.org/html/rfc6749#section-10.4 ``` POST xxx/refresh?refresh_token=XXX&client_id=YYY&grant_type=refresh_token&client_secret ... ``` expiration currently must be handled by you in `failure` callback, and reconnect then

kerem commented

2026-03-03 16:45:18 +03:00

Author

Owner

@phimage commented on GitHub (Nov 19, 2015):

Facebook work fine and added to demo f890cb9a5c
and maybe work only with http scheme like LinkedIn (not tested with custom one)
https://github.com/dongri/OAuthSwift/wiki/API-with-only-HTTP-scheme-into-callback-URL

@phimage commented on GitHub (Nov 19, 2015): 2) Facebook work fine and added to demo f890cb9a5c4456a368410366eb0fad84d65529d1 and maybe work only with http scheme like LinkedIn (not tested with custom one) https://github.com/dongri/OAuthSwift/wiki/API-with-only-HTTP-scheme-into-callback-URL

kerem commented

2026-03-03 16:45:18 +03:00

Author

Owner

@phimage commented on GitHub (Dec 4, 2015):

3/ Wiki page on expiration
https://github.com/dongri/OAuthSwift/wiki/OAuth-2.0-Token-Expiration

maybe I will add an utility function to check expiration (or we can throw a specific exception for that...)
I think framework will never do it automatically because many oauth provider change the code or error message

@phimage commented on GitHub (Dec 4, 2015): 3/ Wiki page on expiration https://github.com/dongri/OAuthSwift/wiki/OAuth-2.0-Token-Expiration maybe I will add an utility function to check expiration (or we can throw a specific exception for that...) I think framework will never do it automatically because many oauth provider change the code or error message