coolaj86
/
oauth3.js
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
oauth3.js/README.md

503 lines
16 KiB
Markdown
Raw Permalink Normal View History

add brief README.md
2017-01-18 03:46:01 +00:00
oauth3.js
=========
update urls
2017-11-10 18:50:09 +00:00
| *oauth3.js*
| [issuer.html](https://git.oauth3.org/OAuth3/issuer.html)
| [issuer.rest.walnut.js](https://git.oauth3.org/OAuth3/issuer.rest.walnut.js)
update URLs
2017-11-13 17:52:00 +00:00
| [issuer.srv](https://git.oauth3.org/OAuth3/issuer.srv)
update links
2018-04-23 22:10:10 +00:00
| Sponsored by [ppl](https://ppl.family)
update urls
2017-11-10 18:50:09 +00:00
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
The world's smallest, fastest, and most secure OAuth3 (and OAuth2) JavaScript implementation
(Yes! works in browsers and node.js with no extra dependencies or bloat and no hacks!)
Instead of bloating your webapp and ruining the mobile experience,
you can use a single, small javascript file for all OAuth3 providers
fixed some spelling errors in the README
2017-03-07 21:54:08 +00:00
(and almost all OAuth2 providers) with a seamless experience.
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
Also, instead of complicated (or worse - insecure) CLI and Desktop login methods,
you can easily integrate an OAuth3 flow (or broker) into any node.js app (i.e. Electron, Node-Webkit)
with 0 pain.
update docs
2017-02-21 22:32:45 +00:00
If you have no idea what you're doing
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
------------
update docs
2017-02-21 22:32:45 +00:00
(people who know what they're doing should skip ahead to the tl;dr instructions)
1. Create a folder for your project named after your app, such as `example.com/`
2. Inside of the folder `example.com/` a folder called `assets/`
renamed
2017-11-09 22:25:19 +00:00
3. Inside of the folder `example.com/assets` a folder called `oauth3.org/`
update urls
2017-11-10 19:47:29 +00:00
4. Download [oauth3.js-v1.zip](https://git.oauth3.org/OAuth3/oauth3.js/repository/archive.zip?ref=v1)
update docs
2017-02-21 22:32:45 +00:00
5. Double-click to unzip the folder.
renamed
2017-11-09 22:25:19 +00:00
6. Copy the file `oauth3.core.js` into the folder `example.com/assets/oauth3.org/`
.well-known => _apis
2018-07-06 00:45:58 +00:00
7. Copy the folder `_apis` into the folder `example.com/`
renamed
2017-11-09 22:25:19 +00:00
9. Add `<script src="assets/oauth3.org/oauth3.core.js"></script>` to your `index.html`
update docs
2017-02-21 22:32:45 +00:00
9. Add `<script src="app.js"></script>` to your `index.html`
10. Create files in `example.com` called `app.js` and `index.html` and put this in it:
`index.html`:
```html
<!DOCTYPE html>
<html>
<head>
</head>
<body>
<input type="url" placeholder="ex: https://oauth3.org" class="js-provider-uri">
<button type="button" class="js-login">Login</button>
<button type="button" class="js-logout">Logout</button>
<script src="https://code.jquery.com/jquery-3.1.1.js"
integrity="sha256-16cdPddA6VdVInumRGo6IbivbERE8p7CQR3HzTBuELA="
crossorigin="anonymous"></script>
renamed
2017-11-09 22:25:19 +00:00
<script src="assets/oauth3.org/oauth3.core.js"></script>
update docs
2017-02-21 22:32:45 +00:00
<script src="app.js"></script>
</body>
</html>
```
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
update docs
2017-02-21 22:32:45 +00:00
`app.js`:
```js
var OAUTH3 = window.OAUTH3;
typo auth => oauth3
2018-07-06 05:48:25 +00:00
var oauth3 = OAUTH3.create(window.location); // use window.location to set Client URI (your app's id)
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
update docs
2017-02-21 22:32:45 +00:00
// this is any OAuth3-compatible provider, such as oauth3.org
// in v1.1.0 we'll add backwards compatibility for facebook.com, google.com, etc
//
typo fix _providerUri => providerUri
2018-07-06 05:56:01 +00:00
function onChangeProvider(providerUri) {
update docs
2017-02-21 22:32:45 +00:00
// example https://oauth3.org
updates and add setIdentityProvider and setResourceProvider
2017-06-14 22:39:26 +00:00
return oauth3.setIdentityProvider(providerUri);
update docs
2017-02-21 22:32:45 +00:00
}
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
update docs
2017-02-21 22:32:45 +00:00
// This opens up the login window for the specified provider
//
function onClickLogin() {
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
updates and add setIdentityProvider and setResourceProvider
2017-06-14 22:39:26 +00:00
return oauth3.authenticate().then(function (session) {
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
update docs
2017-02-21 22:32:45 +00:00
console.info('Authentication was Successful:');
console.log(session);
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
fixed some spelling errors in the README
2017-03-07 21:54:08 +00:00
// You can use the PPID (or preferably a hash of it) as the login for your app
update docs
2017-02-21 22:32:45 +00:00
// (it securely functions as both username and password which is known only by your app)
// If you use a hash of it as an ID, you can also use the PPID itself as a decryption key
//
console.info('Secure PPID (aka subject):', session.token.sub);
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
updates and add setIdentityProvider and setResourceProvider
2017-06-14 22:39:26 +00:00
return oauth3.request({
retrieve signing key
2018-07-06 08:12:13 +00:00
url: 'https://api.oauth3.org/api/issuer@oauth3.org/jwks/:sub/:kid'
.replace(/:sub/g, session.token.sub)
.replace(/:kid/g, session.token.kid || session.token.iss)
update docs
2017-02-21 22:32:45 +00:00
, session: session
}).then(function (resp) {
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
retrieve signing key
2018-07-06 08:12:13 +00:00
console.info("Signing Public Key JWK:");
update docs
2017-02-21 22:32:45 +00:00
console.log(resp.data);
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
update docs
2017-02-21 22:32:45 +00:00
});
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
update docs
2017-02-21 22:32:45 +00:00
}, function (err) {
console.error('Authentication Failed:');
console.log(err);
});
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
update docs
2017-02-21 22:32:45 +00:00
}
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
update docs
2017-02-21 22:32:45 +00:00
// This opens up the logout window
//
function onClickLogout() {
updates and add setIdentityProvider and setResourceProvider
2017-06-14 22:39:26 +00:00
return oauth3.logout().then(function () {
update docs
2017-02-21 22:32:45 +00:00
localStorage.clear();
console.info('Logout was Successful');
}, function (err) {
console.error('Logout Failed:');
console.log(err);
});
}
// initialize the provider to be oauth3.org (or any compatible provider)
//
onChangeProvider('oauth3.org');
$('body').on('click', '.js-login', onClickLogin);
$('body').on('click', '.js-logout', onClickLogout);
$('body').on('change', 'input.js-provider-uri', onChangeProvider);
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
```
update docs
2017-02-21 22:32:45 +00:00
Copy the `example.com/` folder to your webserver.
add filetree
2017-02-15 18:09:08 +00:00
Example
-------
If you had a simple website / webapp for `example.com` with only the most necessary files,
it might look like this:
```
example.com
│
│
.well-known => _apis
2018-07-06 00:45:58 +00:00
├── _apis
│   └── oauth3.org
add filetree
2017-02-15 18:09:08 +00:00
│   ├── callback.html
│   ├── directives.json
│   └── index.html
├── assets
.well-known => _apis
2018-07-06 00:45:58 +00:00
│   └── oauth3.org
update docs
2017-02-21 22:32:45 +00:00
│   └── oauth3.core.js
add filetree
2017-02-15 18:09:08 +00:00
│
│
├── css
│   └── main.css
├── index.html
└── js
└── app.js
```
update docs
2017-02-21 22:32:45 +00:00
Installation (if you know what you're doing)
------------
**Advanced Installation with `git`**
```bash
# Navigate to your web site or web app
pushd /path/to/your/web/app
.well-known => _apis
2018-07-06 00:45:58 +00:00
# clone the project as assets/oauth3.org
update docs
2017-02-21 22:32:45 +00:00
mkdir -p assets
.well-known => _apis
2018-07-06 00:45:58 +00:00
git clone git@git.oauth3.org:OAuth3/oauth3.js.git assets/oauth3.org
pushd assets/oauth3.org
update docs
2017-02-21 22:32:45 +00:00
git checkout v1
popd
.well-known => _apis
2018-07-06 00:45:58 +00:00
# symlink `_apis/oauth3.org` to `assets/oauth3.org/_apis/oauth3.org`
mkdir -p _apis
ln -sf ../assets/oauth3.org/_apis/oauth3 _apis/oauth3.org
update docs
2017-02-21 22:32:45 +00:00
```
**Advanced Installation with `bower`**
```bash
# Install to bower_components
bower install oauth3
.well-known => _apis
2018-07-06 00:45:58 +00:00
# create a `_apis` folder and an `assets` folder
mkdir -p _apis assets
update docs
2017-02-21 22:32:45 +00:00
.well-known => _apis
2018-07-06 00:45:58 +00:00
# symlink `_apis/oauth3.org` to `bower_components/oauth3.org/_apis/oauth3.org`
ln -sf ../bower_components/oauth3.org/_apis/oauth3.org _apis/oauth3.org
update docs
2017-02-21 22:32:45 +00:00
.well-known => _apis
2018-07-06 00:45:58 +00:00
# symlink `assets/oauth3.org` to `bower_components/oauth3.org`
ln -sf ../bower_components/oauth3.org/_apis/oauth3.org _apis/oauth3.org
ln -sf ../bower_components/oauth3.org assets/oauth3.org
update docs
2017-02-21 22:32:45 +00:00
```
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
Usage
-----
update docs
2017-02-14 23:19:21 +00:00
Update your HTML to include the the following script tag:
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
update docs
2017-02-14 23:19:21 +00:00
```html
.well-known => _apis
2018-07-06 00:45:58 +00:00
<script src="assets/oauth3.org/oauth3.core.js"></script>
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
```
update docs
2017-02-14 23:19:21 +00:00
You can create a very simple demo application like this:
```javascript
var providerUri;
Fix README.md typo in example.
2017-02-19 04:48:46 +00:00
var opts = { client_uri: OAUTH3.utils.clientUri(window.location) };
update docs
2017-02-14 23:19:21 +00:00
// this is any OAuth3-compatible provider, such as oauth3.org
// in v1.1.0 we'll add backwards compatibility for facebook.com, google.com, etc
//
function onChangeProvider(_providerUri) {
providerUri = _providerUri;
Fix README.md typo in example.
2017-02-19 04:48:46 +00:00
return OAUTH3.discover(providerUri, opts); // just to cache
update docs
2017-02-14 23:19:21 +00:00
}
// This opens up the login window for the specified provider
//
function onClickLogin() {
return OAUTH3.implicitGrant(providerUri, opts).then(function (session) {
console.info('Authentication was Successful:');
console.log(session);
fixed some spelling errors in the README
2017-03-07 21:54:08 +00:00
// You can use the PPID (or preferably a hash of it) as the login for your app
update docs
2017-02-14 23:19:21 +00:00
// (it securely functions as both username and password which is known only by your app)
// If you use a hash of it as an ID, you can also use the PPID itself as a decryption key
//
console.info('Secure PPID (aka subject):', session.token.sub);
return OAUTH3.request({
update examples
2017-08-10 20:54:34 +00:00
url: 'https://oauth3.org/api/issuer@oauth3.org/inspect_token'
update docs
2017-02-14 23:19:21 +00:00
, session: session
}).then(function (resp) {
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
update docs
2017-02-14 23:19:21 +00:00
console.info("Inspect Token:");
console.log(resp.data);
});
}, function (err) {
console.error('Authentication Failed:');
console.log(err);
});
}
// initialize the provider to be oauth3.org (or any compatible provider)
//
onChangeProvider('oauth3.org');
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
```
update docs
2017-02-14 23:19:21 +00:00
update README
2017-07-07 17:45:37 +00:00
A user's e-mail can be passed into the clientParams object as `clientParams.subject`.
To auto-populate the e-mail input of the login popup, make sure the input has the class `js-oauth3-email`.
Example:
```js
if (clientParams.subject) {
$('.js-oauth3-email').val(clientParams.subject);
$('.js-authn-show').prop('disabled', false);
}
```
update docs
2017-02-14 23:19:21 +00:00
### Compatibility with Frameworks and Libraries
**jQuery**:
You're all set. Nothing else is needed.
**Angular 1**:
We've created an `Oauth3` service just for you:
```html
.well-known => _apis
2018-07-06 00:45:58 +00:00
<script src="assets/oauth3.org/oauth3.ng.js"></script>
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
```
update docs and ng api
2017-08-10 20:35:24 +00:00
```js
// Require the module as 'oauth3.org'
var app = angular.module('myAppName', [ 'ui.router', 'oauth3.org' ]);
// Require services and other submodules in the form {modulename}@oauth3.org
app.controller('authCtrl', [ '$scope', 'azp@oauth3.org', function ($scope, Oauth3) { /* ... */ } ]);
// For backwards compatibility with older angular applications that rely on string-name introspection
// you can also use the camel case version of the names in the format {Modulename}Oauth3
app.controller('authCtrl', function ($scope, AzpOauth3) { /* ... */ });
```
update docs
2017-02-14 23:19:21 +00:00
You can include that in addition to the standard file or,
if you don't want an extra request, just paste it into your `app.js`.
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
update docs
2017-02-21 22:32:45 +00:00
Simple API
----------
We include a small wrapper function of just a few lines in the bottom of `oauth3.core.js`
which exposes a `create` method to make using the underlying library require typing fewer keystrokes.
```
updates and add setIdentityProvider and setResourceProvider
2017-06-14 22:39:26 +00:00
oauth3 = OAUTH3.create(location); // takes a location object, such as window.location
// to create the Client URI (your app's id)
// and save it to an internal state
update docs
2017-02-21 22:32:45 +00:00
update docs and ng api
2017-08-10 20:35:24 +00:00
promise = oauth3.init(opts); // set and fetch your own site/app's configuration details
// promises your site's config // opts = { location, session, issuer, audience }
update docs
2017-02-21 22:32:45 +00:00
updates and add setIdentityProvider and setResourceProvider
2017-06-14 22:39:26 +00:00
promise = oauth3.setIdentityProvider(url); // changes the Identity Provider URI (the site you're logging into),
.well-known => _apis
2018-07-06 00:45:58 +00:00
// promises the provider's config // gets the config for that site (from their _apis/oauth3.org),
updates and add setIdentityProvider and setResourceProvider
2017-06-14 22:39:26 +00:00
// and caches it in internal state as the default
update docs
2017-02-21 22:32:45 +00:00
updates and add setIdentityProvider and setResourceProvider
2017-06-14 22:39:26 +00:00
promise = oauth3.setResourceProvider(url); // changes the Resource Provider URI (the site you're getting stuff from)
update docs
2017-02-21 22:32:45 +00:00
updates and add setIdentityProvider and setResourceProvider
2017-06-14 22:39:26 +00:00
promise = oauth3.setProvider(url); // changes the both Identity and Resource Provider URI together
update docs
2017-02-21 22:32:45 +00:00
updates and add setIdentityProvider and setResourceProvider
2017-06-14 22:39:26 +00:00
promise = oauth3.authenticate(); // opens login window for the provider and returns a session
// (must be called after the setIdentityProvider promise has completed)
update docs
2017-02-21 22:32:45 +00:00
updates and add setIdentityProvider and setResourceProvider
2017-06-14 22:39:26 +00:00
promise = oauth3.authorize(permissions); // authenticates (if not authenticated) and opens a window to
// authorize a particular scope (contacts, photos, whatever)
update docs
2017-02-21 22:32:45 +00:00
add prototype docs
2017-08-10 21:15:54 +00:00
promise = oauth3.request({ url, method, data }); // make an (authorized) arbitrary request to an audience's resource
updates and add setIdentityProvider and setResourceProvider
2017-06-14 22:39:26 +00:00
// (contacts, photos, whatever)
add prototype docs
2017-08-10 21:15:54 +00:00
promise = oauth3.api(apiname, opts); // make an (authorized) well-known api call to an audience
update links
2018-04-23 22:10:10 +00:00
// Ex: oauth3.api('dns.list', { sld: 'example', tld: 'com' });
add prototype docs
2017-08-10 21:15:54 +00:00
// TODO
api = await oauth3.package(audience, schemaname); // make an (authorized) well-known api call to an audience
update links
2018-04-23 22:10:10 +00:00
// Ex: api = await oauth3.package('domains.example.com', 'dns@oauth3.org');
add prototype docs
2017-08-10 21:15:54 +00:00
// api.list({ sld: 'mydomain', tld: 'com' });
updates and add setIdentityProvider and setResourceProvider
2017-06-14 22:39:26 +00:00
promise = oauth3.logout(); // opens logout window for the provider
oauth3.session(); // returns the current session, if any
update docs
2017-02-21 22:32:45 +00:00
```
update links
2018-04-23 22:10:10 +00:00
<!-- TODO
Track down the old https://labs.daplie.com/docs/ for API schemas
--
update docs
2017-02-21 22:32:45 +00:00
Real API
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
----------
update docs
2017-02-14 23:19:21 +00:00
<!-- hooks -->
update README
2017-02-15 17:50:53 +00:00
```
update docs
2017-02-21 22:32:45 +00:00
OAUTH3.clientUri(window.location); // produces the default `client_uri` of your app (also used as `client_id`)
update README
2017-02-15 17:50:53 +00:00
OAUTH3.discover(providerUri, { client_id: clientUri }); // Promises the config file for the provider and caches it in memory.
OAUTH3.implicitGrant(providerUri, { client_id: clientUri }) // returns a `session` with `session.token.sub` as the secure ppid.
// debug: true - will cause the windows to not refresh automatically
// windowType: 'popup' - will use a popup window to ask user for new permissions, if any
// windowType: 'background' - will automatically log the user in (if all permissions have been accepted)
OAUTH3.request({ method: 'GET', url: '', session: '', data: '' }) // make an authenticated request to a resource
OAUTH3.logout(providerUri, { client_id: clientUri, session: session }) // opens a popup to confirm logout from the provider
// Note: you should probably clear your own storage (i.e. localStorage, indexedDb) whenever you call this
OAUTH3.urls
.discover(providerUri, { client_id: clientUri }) // generates a correctly parameterized url
.implicitGrant(directives, { client_id: clientUri }) // generates a correctly parameterized url
.refreshToken(directives, opts) // generates a correctly parameterized url
// opts.client_id = clientUri
// opts.access_token = <jwt>
// opts.refresh_token = <jwt>
```
update docs
2017-02-14 23:19:21 +00:00
<!-- TODO implicit grant broker -->
<!-- TODO logout specific user -->
<!-- TODO request(providerUri, opts) -->
<!-- TODO login/logout(directives, opts) ? -->
update docs
2017-02-21 22:32:45 +00:00
Core API (staging)
update docs
2017-02-14 23:19:21 +00:00
----------
These APIs are NOT yet public, stable APIs, but they are good to be aware of
and may help with debugging.
DO NOT rely on them. Many of them WILL change (we just wanted to publish with things as they are).
add brief README.md
2017-01-18 03:46:01 +00:00
Public utilities for browser and node.js:
update README
2017-02-15 17:50:53 +00:00
```
OAUTH3.jwt
.decode('<urlSafeBase64-encoded-json-web-token>'); // { iat, iss, aud, sub, exp, ttl }
update docs
2017-02-21 22:32:45 +00:00
OAUTH3
update README
2017-02-15 17:50:53 +00:00
.query.stringify({ access_token: '...', debug: true }); // access_token=...&debug=true
.scope.stringify([ 'profile', 'contacts' ]); // 'profile,contacts'
.uri.normalize('https://oauth3.org/connect/'); // 'oauth3.org/connect'
.url.normalize('oauth3.org/connect/'); // 'https://oauth3.org/connect'
.url.resolve('oauth3.org/connect/', '/api/'); // 'https://oauth3.org/connect/api'
update docs
2017-02-21 22:32:45 +00:00
```
Issuer API (staging)
-------------------
These additional methods are
```
OAUTH3
.query.parse('#/?foo=bar&baz=qux'); // { access_token: '...', debug: 'true' }
.scope.parse('profile,contacts'); // [ 'profile', 'contacts' ]
.url.redirect(clientParams, grants, tokenOrError); // securely redirect to client (or give security or other error)
update README
2017-02-15 17:50:53 +00:00
```
add brief README.md
2017-01-18 03:46:01 +00:00
update docs
2017-02-14 23:19:21 +00:00
Internal API
------------
This APIs will absolutely change before they are made public
(at the very least the leading `_` will be removed)
update README
2017-02-15 17:50:53 +00:00
```
OAUTH3.jwt
.freshness(tokenMeta, staletimeSeconds, _now); // returns 'fresh', 'stale', or 'expired' (by seconds before expiry / ttl)
update docs
2017-02-14 23:19:21 +00:00
update docs
2017-02-21 22:32:45 +00:00
OAUTH3
update README
2017-02-15 17:50:53 +00:00
.url._normalizePath('oauth3.org/connect/'); // 'oauth3.org/connect'
.randomState(); // a 128-bit crypto-random string
._insecureRandomState(); // a fallback for randomState() in old browsers
update docs
2017-02-21 22:32:45 +00:00
._base64.atob('<non-urlsafe-base64-string>'); // '<binary-string>' (typically json ascii)
._base64.decodeUrlSafe(b64); // makes base64 safe for window.atob and then calls atob
update docs
2017-02-14 23:19:21 +00:00
update README
2017-02-15 17:50:53 +00:00
OAUTH3._browser // a collection of things a browser needs to perform requests
```
add consideration of URI vs URL vs Pathname
2017-02-07 19:19:57 +00:00
WIP cleanup and doc
2017-02-13 19:35:48 +00:00
Roadmap
-------
* v1.0 - "implicit grant" authorization with examples
* popup
* iframe
* documentation
* v1.1 - cleanup
* in-flow discovery
* smallest possible size
* inline windowing (non-promisable callback)
* async set/get
* logout
* v1.2 - features
* "authorization code" flow
* "broker" flow
* v1.3 - features
* remove grants
update docs
2017-02-14 23:19:21 +00:00
URL generation:
* `authorizationCode`
* `authorizationRedirect`
* `implicitGrant`
* `loginCode`
* `resourceOwnerPassword`
add consideration of URI vs URL vs Pathname
2017-02-07 19:19:57 +00:00
URI vs URL
----------
See <https://danielmiessler.com/study/url-uri/#gs.=MngfAk>
Since we do not require the `protocol` to be specified, it is a URI
However, we do have a problem of disambiguation since a URI may look like a `path`:
update examples
2017-08-10 20:54:34 +00:00
1. https://example.com/api/issuer@oauth3.org
2. example.com/api/issuer@oauth3.org/ (not unique)
3. /api/issuer@oauth3.org
4. api/issuer@oauth3.org (not unique)
add consideration of URI vs URL vs Pathname
2017-02-07 19:19:57 +00:00
Therefore anywhere a URI or a Path could be used, the URI must be a URL.
We eliminate #2.
As a general rule I don't like rules that sometimes apply and sometimes don't,
so I may need to rethink this. However, there are cases where including the protocol
can be very ugly and confusing and we definitely need to allow relative paths.
fixed some spelling errors in the README
2017-03-07 21:54:08 +00:00
A potential work-around would be to assume all paths are relative (eliminate #4 instead)
add consideration of URI vs URL vs Pathname
2017-02-07 19:19:57 +00:00
and have the path always key off of the base URL - if oauth3 directives are to be found at
.well-known => _apis
2018-07-06 00:45:58 +00:00
https://example.com/username/_apis/oauth3.org/index.json then /api/whatever would refer
add consideration of URI vs URL vs Pathname
2017-02-07 19:19:57 +00:00
to https://example.com/username/api/whatever.