Also how do you implement code flow at the end of ...
# ask-a-descoperr
red-television-97230
08/09/2023, 4:39 AMAlso how do you implement code flow at the end of a flow for sign in/up
g
gifted-florist-65280
08/09/2023, 8:09 AMwhat do you mean by ‘code flow’ at the end of a sign in/up flow?
r
red-television-97230
08/09/2023, 1:27 PMCorrect
g
gifted-florist-65280
08/09/2023, 1:49 PMnot quite following.. what do you mean?
r
red-television-97230
08/09/2023, 3:17 PMAuth Code flow is the process for OIDC where the backend gets a code and you exchange it for Access and ID tokens
g
gifted-florist-65280
08/09/2023, 5:09 PMoh got it - it’s OIDC related
there’s actually a really good document on OIDC in Descope - https://docs.descope.com/customize/auth/oidc/
we also have some great articles around integrating with other frameworks, such as Firebase, Cognito and Auth0, and we’ve just recently released a guide on ReTool too 🙂
let me know if this was helpful to you 🙏🏼
r
red-television-97230
08/09/2023, 5:26 PMThe problem is you have implicit flow where you send the session token through the front end. I need to able to get a secure one through the backend
g
gifted-florist-65280
08/09/2023, 5:41 PM@orange-belgium-27264 @rapid-doctor-25622 can you please help Daniel?
o
orange-belgium-27264
08/09/2023, 5:43 PM
We support both implicit (with PKCE) and explicit
You use explicit in the backend with a Descope access key as the client secret
orange-belgium-27264
08/09/2023, 5:45 PM
See https://authjs.dev/reference/core/providers_descope for example implementation
r
red-television-97230
08/09/2023, 5:59 PMHi Omer, is there a call back url in the flows I can call. Seems to only be tied to Social providers.
o
orange-belgium-27264
08/09/2023, 6:01 PM
Our api is code exchange without secret
We also support OIDC via standard endpoints
Can you provide more context on what you're trying to do exactly? It will help us point you in the right direction
orange-belgium-27264
08/09/2023, 6:02 PM
Are you using our SDK or using a standard OIDC client ?
r
red-television-97230
08/09/2023, 6:46 PMstandard OIDC
red-television-97230
08/09/2023, 6:46 PMI have it built directly into flask (python)
red-television-97230
08/09/2023, 6:47 PMI am trying to use the sign up/in widget embedded on our site using HTML.
red-television-97230
08/09/2023, 6:47 PMThen when the user completes the login it should redirect the user with a code to our /callback
red-television-97230
08/09/2023, 6:48 PMWhen it hits the callback with the code I exchange it for a token/refresh token
red-television-97230
08/09/2023, 6:48 PMThen I push the token to the users cookies/session for access to the website
red-television-97230
08/09/2023, 6:48 PMThis will also be done using Unity on our mobile app
red-television-97230
08/09/2023, 6:49 PMred-television-97230
08/09/2023, 6:50 PMThe trick here is I was hoping to use your Login pages and flows to manage the user experience and not have to build it all out.
red-television-97230
08/09/2023, 6:54 PMMy concern is man in the middle attacks with implicit flow
o
orange-belgium-27264
08/09/2023, 6:55 PM
Take a look at our Django plugin on how we embed the flow in the app https://github.com/descope/django-descope/tree/main
orange-belgium-27264
08/09/2023, 6:56 PM
With implicit flow you should implement PKCE to address man in the middle concerns
Standard OIDC clients should be able to handle that for you
r
red-television-97230
08/09/2023, 6:57 PMYes, its ok, but code flow with PKCE is really the best and we are talking in our use case millions of dollars at stake
red-television-97230
08/09/2023, 6:57 PMSo any idea around implicit flow isn't great. Its ok, but not the best.
red-television-97230
08/09/2023, 6:57 PMsession_token = request.session.get(SESSION_COOKIE_NAME)
refresh_token = request.session.get(REFRESH_SESSION_COOKIE_NAME)
logger.debug("Validating (and refreshing) Descope session")
try:
validated_session = descope_client.validate_and_refresh_session(
session_token, refresh_token
)
red-television-97230
08/09/2023, 6:58 PMI figured this is what you were doing, but it doesn't kill the original session token.
red-television-97230
08/09/2023, 6:59 PMIs there any way to add a step in your process to send the user with a code as part of a flow
red-television-97230
08/09/2023, 6:59 PMI thought I saw it in your social Sign-in flow
red-television-97230
08/09/2023, 7:01 PMThe rest is perfect. Any chance we can add that?
o
orange-belgium-27264
08/09/2023, 8:04 PM
it doesn’t kill the original session because it still uses it, the clients hands over the session/refresh tokens to the server to manage
this was done due to the fullstack nature of django, I would generally advise against sharing the refresh token and only provide your app with the session token to authorize protected resources
r
red-television-97230
08/10/2023, 4:12 AMHi Omer, so i'm stuck on getting the callback to my site from the hosted login page