chrome-ex-oauth2's Introduction

Chrome Extension OAuth2 Library

Provides a simple way to retrieve an OAuth2 token for API authorization within a Google Chrome Extension.

How To Use

Add the following to your extension manifest:

Note: The permissions url and content_script > matches URL are determined by the API you are requesting authorization for.

{
	...
	...
	
	"permissions":{
		"https://github.com/login/oauth/access_token",
		"tabs"
	},
	
	"content_scripts":[{
		"matches":["https://github.com/robots.txt*"],
		"js":["libs/chrome-ex-oauth2/injection.js"],
		"run_at":"document_start"
	}],
	
	...
	...
}

Add application and API information to libs/chrome-ex-auth/oauth2.js:

	(function() {
		window.oauth2 = {
		
		access_token_url: "{your-access-token-url}",
		authorization_url: "{your-authorization-url}",
		client_id: "{your-client-id}",
		client_secret: "{your-client-secret}",
		redirect_url: "{your-redirect-url}",
		scopes: [{your-array-of-scopes}],
		
		...
		...
	
	})();

Include the authorization script in your project:

<html>
...
...
<body>
	...
	...
	
	<script src="libs/chrome-ex-oauth/oauth2.js"></script>
	
	...
	...
</body>
</html>

To authorize the application from your script:
```
window.oauth2.start();
```
Include attribution to library.

API

start()

Starts the authorization process.

getToken()

Retrieves the applications authorization token from the browsers local storage.

clearToken()

Clears the applications token from the browsers local storage.

-- _{This library has only been tested with the GitHub API v3}

chrome-ex-oauth2's People

Contributors

Stargazers

Watchers

chrome-ex-oauth2's Issues

Where do I get tokens?

In step 2, you outline that I need to have these tokens:

        access_token_url: "{your-access-token-url}",
        authorization_url: "{your-authorization-url}",
        client_id: "{your-client-id}",
        client_secret: "{your-client-secret}",
        redirect_url: "{your-redirect-url}",
        scopes: [{your-array-of-scopes}],

Do you know the best way to get these? What if my extension doesn't have a redirect url, or I am working in development mode?

what if my client secret has exposed?

this implementation looks great.
but I have a question.
chrome extension is distributed in ZIP with javascript source inside.
is there any way to avoid my client secret being exposed?

Recommend Projects