You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Jan 5, 2023. It is now read-only.
SwAuth is a OAuth 2.0 library for iOS 15.0+, macOS 12.0+, watchOS 8.0+, and tvOS 15.0+ written in Swift.
3
+
SwAuth is an OAuth 2.0 HTTP request library for written in Swift iOS 15.0+, macOS 12.0+, watchOS 8.0+, and tvOS 15.0+.
4
4
5
5
## Features
6
6
7
7
-[x] Usable and beautiful syntax with async/await! Say goodbye to completion handler hell!
8
-
-[x] Authorization Code Grant (RFC 6749/6750), Proof Key for Code Exchange (PKCE) extension for Authorization Code Grant (RFC 7636), and the Device Authorization Grant (RFC 8628).
8
+
-[x]Supports Authorization Code Grant (RFC 6749/6750), Proof Key for Code Exchange (PKCE) extension for Authorization Code Grant (RFC 7636), and the Device Authorization Grant (RFC 8628).
9
9
-[x] Support for all Apple platforms.
10
10
-[x] Retry errored requests.
11
-
-[x]Built on [SwiftNIO](https://github.com/apple/swift-nio) with [AsyncHTTPClient](https://github.com/swift-server/async-http-client). (Suck it URLSession)
4. Start an ASWebAuthenticationSession like in the [example app](https://github.com/Colaski/SwAuth/blob/main/SwAuthTestApp/SwAuthTestApp/ProviderView.swift#L94) with the instance's authorization URL:
68
+
69
+
```swift
70
+
spotify.authorizationURL
71
+
```
72
+
73
+
5. Pass the callback URL from the ASWebAuthenticationSession into the provided handler method:
// Send an authenticated HTTP request, this one will follow the artist Kanye on Spotify.
95
+
let json =tryawait spotify.authenticatedRequest(for: request, numberOfRetries: 2).json()
96
+
97
+
// Prints the JSON output
98
+
print(json)
99
+
} catch {
100
+
print(error.localizedDescription)
101
+
}
102
+
```
103
+
104
+
For more information, read my beautiful documentation: [https://swauth.netlify.app/documentation/Swauth](https://swauth.netlify.app/documentation/Swauth)
105
+
106
+
## Contributing
107
+
108
+
Contributions are welcome!
109
+
110
+
Make sure swift is installed and then
111
+
```bash
112
+
git clone https://github.com/Colaski/SwAuth.git
113
+
cd SwAuth
114
+
swift build
115
+
```
116
+
117
+
Make your changes and submit and a PR for review!
118
+
119
+
Nice to have list:
120
+
121
+
-[ ] Include ready to go implementations of Web API's with endpoints like in the [exmaple app](https://github.com/Colaski/SwAuth/blob/main/SwAuthTestApp/SwAuthTestApp/Spotify.swift)
122
+
- Perhaps Spotify, Google, Azure/Microsoft, Github etc.
Copy file name to clipboardExpand all lines: Sources/SwAuth/SwAuth Documentation.docc/AuthorizationCodeFlow.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
## Getting Started
4
4
5
-
To use the Authorization Code Flow, first create an instance of Keychain and then create an instance of AuthorizationCodeFlow by filling in the information of the WebAPI you wish to utilize. Spotify will be used as an example.
5
+
To use the Authorization Code Flow, first create an instance of Keychain and then create an instance of AuthorizationCodeFlow by filling in the information of the Web API you wish to utilize. Spotify will be used as an example.
6
6
7
7
```swift
8
8
let keychain =Keychain(service: "com.your.bundleID",
@@ -22,7 +22,7 @@ I can now get the authorization URL my user will follow like so:
22
22
let authURL = spotify.authorizationURL
23
23
```
24
24
25
-
SwiftUI users, I recommend using [BetterSafariView](https://github.com/stleamist/BetterSafariView) for following the authorization URL.
25
+
SwiftUI users, I recommend using [BetterSafariView's](https://github.com/stleamist/BetterSafariView) ASWebAuthenticationSession for following the authorization URL.
26
26
27
27
Assuming the user authorizes your application, pass the callback URL into ``authorizationResponseHandler(for:)`` (but of course take into account proper error handling):
SwAuth provides 3 different OAuth 2.0 authorization flows to use: ``AuthorizationCodeFlow``, ``PKCEAuthorizationFlow``, and ``DeviceAuthorizationFlow``. Choosing which one to use and in what context can be difficult.
4
+
5
+
## AuthorizationCodeFlow
6
+
7
+
The ``AuthorizationCodeFlow`` is the most widely supported OAuth 2.0 flow since it is the basic OAuth 2.0 specification. It is used for devices that are not input-constrained (like on iOS, iPadOS, and macOS). However, it should be avoided if at all possible. As the warning I wrote in it's respective documentation states, "The OAuth 2.0 Authorization Code Flow is not secure for native applications, it should only be used when ABSOLUTELY NECESSARY." The reason for this is that in a native app the client secret is included in the source, which you are compiling and distributing. Strings can be pretty easily extracted from compiled binaries, giving someone access to your client secret. Knowing the client secret would allow an attacker to exchange an intercepted authorization code for a token, giving the attacker access to your user's account 😳.
8
+
9
+
Thus, if you are using SwAuth to send authorized requests to your server please implement [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636). I'm sure there is a library or framework that implements it for whatever language you are using server-side ([here's one for Node.js](https://github.com/panva/node-oidc-provider)). If it is not your server, contact the owner and ask about implementing PKCE. If all else fails you may be forced to use the ``AuthorizationCodeFlow``, in which case I'd recommend using some sort of obfuscation and encryption technique for the client secret (at a minimum don't just have a client secret as a plain string). Obfuscation isn't very secure but it's better than nothing.
10
+
11
+
## PKCEAuthorizationFlow
12
+
13
+
Much like the AuthorizationCodeFlow, the ``PKCEAuthorizationFlow`` is used for devices that are not input-constrained (like iOS, iPadOS, and macOS). Unlike the AuthorizationCodeFlow, the PKCE Authorization Code Flow is safe for use in native applications (the spec was created for such purpose). No need to provide the client secret, with PKCE (Proof Key for Code Exchange) an attacker in possesion of an intercepted Authorization Code can't exchange it for a token unless they have the on-device-cryptographically-generated code verifer.
14
+
15
+
The downside is that the Proof Key for Code Exchange extension to the OAuth 2.0 Authorization Code Grant needs to be supported by the Web API you are trying to send requests to. If you own the server, great! implement [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636) and/or find a server-side framework or library that implements it ([again, here's one for Node.js](https://github.com/panva/node-oidc-provider)). Otherwise, ask the owner to implement it.
16
+
17
+
## DeviceAuthorizationFlow
18
+
19
+
The ``DeviceAuthorizationFlow`` is used for use on devices that are input-constrained (like watchOS and tvOS). If the Web API you are trying to send requests to does not support the Device Authorization Grant ask the owner. If you own the server implement it or use a server-side library/framework that supports it.
Copy file name to clipboardExpand all lines: Sources/SwAuth/SwAuth Documentation.docc/DeviceAuthorizationFlow.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
## Getting Started
4
4
5
-
To use the Device Authorization Grant Flow, first create an instance of Keychain and then create an instance of DeviceAuthorizationFlow by filling in the information of the WebAPI you wish to utilize. Google's TV API will be used as an example.
5
+
To use the Device Authorization Grant Flow, first create an instance of Keychain and then create an instance of DeviceAuthorizationFlow by filling in the information of the Web API you wish to utilize. Google's TV authentication will be used as an example.
6
6
7
7
```swift
8
8
let keychain =Keychain(service: "com.your.bundleID",
0 commit comments