RFC 7636 Oauth Proof Key for Code Exchange (for Google)

[jdevries3133]

Hi! I’m working on an app idea that will use the Google Caldav API. I just roughly finished the RFC 7636 Oauth code to get myself an access token / refresh token. This is pretty commonly needed for lots of web projects, not limited to google integrations, so I thought I’d share my implementation here in case it’s useful!

Some things that happen in there;

• http GET and POST request
• preparing and sending over query parameters
• SHA256 hashing
• using new 0.16.x std.Io
• probably lots of bugs from a novice

Enjoy & feedback very appreciated.

libj/src/google_oauth.zig at main · jdevries3133/libj · GitHub.

[jmc]

Looks good from a quick skim, just some nitpicks:

• Asking the user to paste the URL into the tool (while the browser might be actively trying to redirect to a local address that’s not responding) is not great UX: as a future development, you could spin up a tiny HTTP server to respond to the authorization result callback by grabbing the authorization code to exchange for an access token or by handling the rejection if the user denied authorization. Example from a project of mine (sorry, it’s in C++ because I made bad choices): Making sure you're not a bot!
• Here I would use wr.writeAll(…) instead of using write() and discarding its results (writeAll() ensures all bytes are written to the stream, which in your case should be guaranteed anyway since it’s writing to a static buffer, but…): libj/src/rfc7636_pkce_oauth_flow.zig at f07d223e2e253ef8f157105cc13b3d35217c478b · jdevries3133/libj · GitHub
• Here I guess you could use wr.buffered() instead of slicing yourself? libj/src/rfc7636_pkce_oauth_flow.zig at f07d223e2e253ef8f157105cc13b3d35217c478b · jdevries3133/libj · GitHub