has anyone used cfoauth and been able to get a ref...
# adober
raymondcamden
05/07/2024, 9:22 PMhas anyone used cfoauth and been able to get a refresh token? seems near impossible
b
Bill Nourse
05/07/2024, 10:40 PMHi Ray,
I realize this is not answering your question directly, I avoid using CF ColdFusion... Instead I use Lucee.
So to get tokens...
1. Set a route that handles your redirect URL. Something like /mydomain.com/gimmemytoken.cfm.
2. Build a request URL that includes clientID, scope, redirect URL, and state. Then send it to their oauth api.
3. When the request comes back to your server, use url.code and url.state to build your token request.
For that, I use something like this...
http url=this.token_endpoint method="post" result="result" timeout="1000"{
httpparam type="header" name="Content-Type" value="application/x-www-form-urlencoded";
httpparam type='header' name='Authorization' value="Basic " & auth;
httpparam type='header' name='Host' value='oauth.platform';
httpparam type="body" value=postBody;
};
Hey, if ColdFusion can do all that for you, I would be absolutely amazed.
👍 1
q
quetwo
05/08/2024, 12:00 PMRay -- from what I understand you shouldn't have to manage the refresh tokens yourself. It's supposed to auto-renew on it's own, as long as your session is still active.
quetwo
05/08/2024, 12:02 PMAt least, that's what I found when I was first working with it. We ended up having to roll our own because ACF would randomly end sessions (actually make the call to end the session) on it's own, and we couldn't figure out why.
r
raymondcamden
05/08/2024, 12:57 PMBill, thank you, I know how oauth works, I was mainly wondereing why cfoauth doesn't seem to support it.
raymondcamden
05/08/2024, 12:58 PMBill - that's not my understanding. When working w/ Google's oauth directly for ex, you can get an access token -and- refresh token when you exchange the code you get back at the end of the flow. access tokens live for an hour, but refresh ones let you get more later. I want that so I don't have to worry about the token expiring
b
Bill Nourse
05/08/2024, 9:40 PMHi Ray, if I understand you correctly, once I get the first refresh_token, I request (and store) a new refresh_token "prior" to each API call.
To your point, that will keep your refresh_token active forever if your app is being used regularly.
For that, include "grant_type=refresh_token" along with your existing refresh_token in the body of your call. That will return an access_token you can use for the call, and a brand spanking new refresh_token you can store for later.
r
raymondcamden
05/08/2024, 9:42 PMok, but thats the issue - you cant get the refresh_token at all. if you do oauth manual, yes, you can specify you want it and when you exchange the code, you get an access token and rerefresh token.
raymondcamden
05/08/2024, 9:43 PMaccording to the google docs, if you pass access_type=offline, you will be able to get it. i tried using urlparams attribute of cfoauth, but it doesnt work
raymondcamden
05/08/2024, 9:43 PMif i do everything "manually", it works fine
b
Bill Nourse
05/08/2024, 9:46 PMwhen you say manually, does that mean using CURL?
r
raymondcamden
05/08/2024, 9:47 PMno, cfhttp.
raymondcamden
05/08/2024, 9:47 PMwell, also when i generate the linkj myself in cfml
raymondcamden
05/08/2024, 9:47 PMcfoauth handles making, and redirecting for you
b
Bill Nourse
05/08/2024, 9:47 PMokay gotcha
Bill Nourse
05/08/2024, 9:48 PMAs mentioned, I don't use any version of ColdFusion that might have tag named cfoauth. I do this manually as well using cfhttp.
r
raymondcamden
05/08/2024, 9:50 PMyeah, thats what ive done in the past.
b
Bill Nourse
05/08/2024, 9:51 PMPersonally, and no offense to Adobe, but I prefer Lucee. Yes, there are tags missing perhaps, but most of the stuff can be written fairly easily.
Bill Nourse
05/08/2024, 9:52 PMI guess that is the main thing. If you use ColdFusion, it would be nice if a tag like that worked in your favor.
r
raymondcamden
05/08/2024, 9:52 PMim typically not a fan of any CF tag that does stuff on the client, which this kinda does. but i was a bit impressed by it.
4 Views