oauth2 
- Description
- OAuth 2.0 Authorization Protocol
- Latest
- oauth2-0.18.3.tar (.sig), 2025-Sep-10, 40.0 KiB
- Maintainer
- Xiyue Deng <manphiz@gmail.com>, <emacs-devel@gnu.org>
- Website
- https://elpa.gnu.org/packages/oauth2.html
- Browse repository
- CGit or Gitweb
- Badge
To install this package from Emacs, use package-install or list-packages.
Full description
Implementation of the OAuth 2.0 draft. The main entry point is `oauth2-auth-and-store' which will return a token structure, which contains information needed for OAuth2 authentication, e.g. access_token, refresh_token, etc. If the token needs to be refreshed, call `oauth2-refresh-access' on the token and it will be refreshed with a new access_token. The code will also store the new value of the access token for reuse.
Old versions
| oauth2-0.18.2.tar.lz | 2025-Sep-06 | 7.89 KiB |
| oauth2-0.18.tar.lz | 2025-Sep-02 | 7.59 KiB |
| oauth2-0.17.tar.lz | 2024-Aug-30 | 4.03 KiB |
| oauth2-0.16.tar.lz | 2024-Mar-31 | 3.34 KiB |
| oauth2-0.15.el.lz | 2020-Sep-02 | 4.19 KiB |
| oauth2-0.14.el.lz | 2020-Aug-28 | 3.96 KiB |
| oauth2-0.13.el.lz | 2020-Apr-04 | 3.85 KiB |
| oauth2-0.12.el.lz | 2020-Mar-27 | 3.80 KiB |
| oauth2-0.11.el.lz | 2016-Jul-09 | 3.54 KiB |
| oauth2-0.10.el.lz | 2014-Jan-29 | 3.42 KiB |
| oauth2-0.9.el.lz | 2013-Jun-29 | 2.89 KiB |
| oauth2-0.8.el.lz | 2012-Nov-29 | 2.80 KiB |
News
Summary of changes to oauth2.el ------------------------------- (For changes of 0.16 and older please check the git history of the repository of oauth2.el.) * 0.18 ** Support reusing cached access_token before it expires In 0.17 and older version, each time one calls `oauth2-refresh-access' it will refresh the access_token immediately, which is kind of wasteful if the access_token is still valid. Some services will return the same token before it expires, though it would be great to avoid the network request. This has now been implemented. Note: some people may notice that in most cases there is actually no extra network request generated in 0.17 and older versions. This is because auth-source caches the credentials, which is controlled by auth-source-cache-expiry (7200 seconds by default). Because most access_tokens are valid for around 1 hour, it is advised to reduce that value to 3600 seconds or lower, or you may see auth-source login error because the cached credentials are expired, in which case you may call `M-x auth-source-forget-all-cached' to remove the cache and request a new access_token. ** Support OAuth2 PKCE extension Proof Key for Code Exchange is an extension to prevent CSRF and authorization code injection attacks (RFC7636) and supported by most OAuth2 servers. This is now implemented and enabled when passing `use-pkce' as t. ** Another update to plstore id generation The generation of plstore id now also includes `user-name'. This enables the usage of predefined `client-id'/`client-secret' from e.g. thunderbird, evolution, etc. This is because the same client info is shared among accounts, and other access required info like auth-url, token-url, etc. are the same for the same service, which leads to the same plstore id and prevent handling multiple accounts. Adding `user-name' ensures a unique plstore id for each account. This would mean that users would have to re-authenticate for all accounts (like in the last release). * 0.17 ** Changes to plstore id generation and needs to reacquire refresh_token The generation of plstore id used to include `auth-url', `token-url', and `scope'. Now `client-id' is also included. This is required to support multiple accounts of some providers which use the same `auth-url', `token-url', and `scope' (e.g. Gmail), or the generated plstore id is not unique amount accounts. Adding `client-id' solves this problem. The hash function of calculating the plstore id has also changed from MD5 to SHA512 to be more secure. As a result, users of oauth2.el will need to redo the authentication process to get a new refresh_token when upgrading from older version to 0.17. # Local variables: # mode: outline # End: