Using authorization code flow for web client with client secret

Questions OAuth/OIDC
1

Hello,

Using GitHub - okta/okta-auth-js: The official js wrapper around Okta's auth API library version 7.3.0 and I can’t retrieve tokens.

I use the authorization code flow for web client. GitHub - okta/okta-auth-js: The official js wrapper around Okta's auth API

My config is something like that:
{
issuer: ‘my issuer’,
clientId: ‘my client id’,
clientSecret: ‘my client secret’,
redirectUri: window.location.origin + ‘/oidc-callback’,
scopes: [‘openid’, ‘email’],
state: ‘state1’,
// Use authorization_code flow
responseType: ‘code’,
responseMode: ‘query’,
pkce: false
}

For redirect part I use a path routing GitHub - okta/okta-auth-js: The official js wrapper around Okta's auth API
So I do these different steps :

  • Define a redirectUri that maps to a dedicated route in your app
  • Before redirect, save the current route: setOriginalUri
  • Do the redirect to okta: token.getWithRedirect
  • After successful authentication, Okta will redirect back to the configured redirectUri, your app should load on the dedicated callback route
  • On this callback page:
  • call token.parseFromUrl to retrieve tokens
  • Add tokens to the TokenManager: tokenManager.setTokens
  • Read saved route and redirect to it: getOriginalUri

When I call token.parseFromUrl GitHub - okta/okta-auth-js: The official js wrapper around Okta's auth API I’m waiting a call to /token url like explain in the documentation “If an authorization code is present, it will be exchanged for token(s) by posting to the tokenUrl endpoint.”, but nothing happens.
It return just {} for tokens.

In the schema of authorization code flow of Implement authorization by grant type | Okta Developer I’m waiting the step 5 to be done by the library.

The callback is correctly called with the authorization code : /oidc-callback?code=37wzhFrMHAiKBXpxQBOwBtlCLVZnSCGzxfEbzfKqgJg&state=state1

Maybe I’m doing something wrong, not giving the correct options or not calling the right function.
Can you explain me where am I doing wrong please ?

2

Hello,

I am not sure if you trying to run auth-js in server mode or client mode?

  • In client mode (SPA apps) the browser would initialize auth-js, do the authorize flow, and store token in the local browser storage.
  • In server mode auth-js would be initialized in a Node app, the Node app would handle the redirect URI and store tokens.

It is much more common to run auth-js client side, but when using with a public app there is no client_secret. A client_secret would only be used for a web app.

I suggest testing a couple of samples to see which fits your use case best.

1 Like
3

Hello,

We are in the case of a web application. So I try to get token from the client side and then give access token to the back when doing any request.

We try to do this: Implement authorization by grant type | Okta Developer