accounts-js / rest Goto Github PK

We've used the rest client on it's own on various occasions. There is no reason accounts/client will be a peer dependency.

Hi! I need, for my project to use cookie based token storage.
Indeed, I want to be able to authenticate the user in the first request, so I can achieve SSR with restricted data.

How do you recommand to edit the rest API in order to do so?

I was thinking about turning this :

res.json(objectContainingTokens)

into this :

res.Cookie('access-token', tokens.accessToken, {httpOnly:true, secure:true, maxAge:172800} )
res.Cookie('refresh-token', tokens.refreshToken, {httpOnly:true, secure:true, maxAge:1296000000} )
res.json(objectWithoutTokens)

Which other package will I need To edit?

Thank you

In one of the alphas we use, the OAuth provider is a bit different from the current.
There is a code that exposes the OAuth access token using a the req.session.grant.response.access_token and then the provider can verify it.
I tried to update to the latest beta (2) now, but my OAuth provider does not get the accessToken (in authenticate callback).

Maybe we need to allow the developer to expose a custom method that transforms req to params?

Or maybe we can expose the session from req here?

@davidyaha @pradel

The current implementation only returns an object like this:

{
  "message": "User not found"
}

This is not really nice to process, since there's no easy way to identify what went wrong. An error-code would be good.

{
 "errorCode": "userNotFound",
 "message": "The User requested was not found"
}

For resource user

• Change POST - getUser to GET - user
• Change POST - createUser to POST - user

For resource session

• Change POST - loginWithPassword to POST login
• Change POST - refreshTokens to UPDATE session/tokens