Différences

Ci-dessous, les différences entre deux révisions de la page.

--- informatique:oauth [05/09/2025 15:53] – [Mobile & API] cyrille
+++ informatique:oauth [09/09/2025 11:30] (Version actuelle) – [Recherche d'une "bonne" méthode] cyrille
@@ Ligne 124: / Ligne 124: @@
   * [[https://taufanfadhilahiskandar.medium.com/three-ways-to-using-laravel-socialite-5f1280ed3c47|Three ways to using Laravel Socialite]]
   * https://api-platform.com/docs/laravel/
+==== Recherche d'une "bonne" méthode ====
+Exigences:
+  * Ne pas avoir le ''client_secret'' dans l'App
+  * S'assurer que le social login est légitime
+<mermaid 80%>
+sequenceDiagram
+participant User
+participant Mobile
+participant Browser
+participant Api
+participant Auth
+autonumber
+activate User
+User ->> Mobile: Click one provider button
+activate Mobile
+deactivate User
+Mobile ->> Api: request auth provider url<br/>SESSION_COOKIE + STATE
+activate Api
+Api ->> Api: create STATE + SESSION COOKIE
+Api -->> Mobile: return AUTH_PROVIDER_URL<br/>SESSION_COOKIE + STATE
+deactivate Api
+Note over Mobile,Auth: Mobile open the System default Browser
+Mobile ->> Browser: open AUTH_PROVIDER_URL
+activate Browser
+activate Auth
+Browser ->> Auth: request AUTH_PROVIDER_URL
+Auth -->> Browser: return auth ui
+deactivate Auth
+deactivate Mobile
+activate User
+Browser -->> User: read access scopes & login ui
+User ->> Browser: click Accept or Denied
+activate Auth
+Browser ->> Auth: post auth form
+deactivate User
+deactivate Browser
+activate Api
+critical Auth Protocol
+Auth ->> Api: "Auth callback with 'code'"
+Api ->> Auth: "Request Access"
+Auth -->> Api: "return access"
+end
+Note right of Mobile: http(s) deep link is verified with<br/>"assetlinks.json" & "apple-app-site-association"
+deactivate Auth
+Api -->> Browser: return redirect DEEP_LINK
+deactivate Api
+activate Mobile
+Browser -->> Mobile: return redirect DEEP_LINK
+activate Api
+Mobile ->> Api: request Api Token<br/>with SESSION_COOKIE + STATE
+Api -->> Mobile: return API_TOKEN
+deactivate Api
+deactivate Mobile
+Note over User,Api: Authentified user can request the Api
+activate User
+User ->> Mobile: "do something"
+activate Mobile
+activate Api
+Mobile ->> Api: "request something with API_TOKEN"
+Api -->> Mobile: "return something"
+Mobile -->> User: display what ever
+deactivate Api
+deactivate Mobile
+deactivate User
+</mermaid>