我的oauth2回调页面可以是相同的html页面吗？ 以及我如何获得令牌？

Question

First off, I'm using static html and javascript and C# Web API. So I have a link that calls an oauth2 server, on my html file, say index.html Now is it ok to set the callback page to index.html

It seems to work, and it gets sent to index.html?code=125f0...

Is this ok to do or do I need a seperate callback page. Is code, the token?

Now how should I consume this?The javascript doesn't seem to get hit on the call back. Edit, actually, the javascript seems to get hit on the call, back but I'm not getting anything undefined from:

    $(function () {
        var params = {},
            queryString = location.hash.substring(1),
            regex = /(^&=]+)=([^&*])/g,
            m;
        while (m = regex.exec(queryString)) {
            params[decodeURIComponent(m[1])] = decodeURIComponent(m[2]);
        }
        if (params.error) {
            if (params.error == "access_denied") {
                sAccessToken = "access_denied";
                //alert(sAccessToken);
            }
        } else {
            sAccessToken = params.code;
            alert(sAccessToken);
        }
    });

Also, can my callback page be a C# web api call? And send the token that way. I'm guessing no, cus then you'd never know what user agent is sending it, and couldn't communicate back unless you somehow passed a id and used signalR? It seems better to get it in javascript and send the token to web api. But then can web api make calls to the resource if it has the token?

sorry, I'm still learning

Answer 1

OAuth2 has various "profiles". The "Authorization Code Grant" flow (what you are using) requires a server side component that exchanges the code for token.

Single Page Applications, typically use the implicit flow. See here for a quick description: https://docs.auth0.com/protocols#5 (ignore references to "Auth0", the underlying protocol is the same regardless of the implementation).

See here for a more thorough description of both flows: What is the difference between the 2 workflows? When to use Authorization Code flow?

Answer 2

Sorry, it was sorta of strange question and bad wording. But what I ended up doing is making an HTML callback page which takes in the code. I popup the OAuth2 server page in a window then it calls my callback page. Then my callback page will close the window and pass the code back to my parent page.