Skip to content

(DOCSP-12639): [realm-web] Update Google redirect deprecation note #526

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 9, 2020
Merged

(DOCSP-12639): [realm-web] Update Google redirect deprecation note #526

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions source/web/authenticate.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -532,11 +532,23 @@ to your app.
console.log(`Logged in with id: ${user.id}`);
});

.. admonition:: (Deprecated) Built-In OAuth 2.0 Flow
.. admonition:: Built-In OAuth 2.0 Redirect Limitations for Google
:class: important

The Realm Web SDK no longer includes built-in methods to handle the OAuth 2.0
process. Instead, use the official Google SDK as described above.
The Realm Web SDK includes a built-in process to handle OAuth 2.0 redirect
flows. The process opens a new window where the user authorizes your app and
then redirects to URL that you provide, which allows you to get an access
token and finish logging the user in.
Comment on lines +540 to +541
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically this is an "auth code" and not an access token and technically it's not the "user" that gets the code, but the SDK - since they don't need to handle it manually (other than calling Realm.handleAuthRedirect()).


Due to changes in OAuth application verification requirements, the built-in
process faces limitations when authenticating :ref:`Google
<google-authentication>` users. If you use the Google login redirect flow
using Realm's redirect flow, a maximum of 100 Google users may authenticate
while the app is in development/testing/staging and all users will see an
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"while the app is in development/testing/staging" => "while the app's consent screen isn't verified"

unverified application notification before they authenticate.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps add "these are limitations imposed by Google".


To avoid these limitations, we advise that you use the official Google SDK to
get a user access token as described above.

.. _web-login-apple:

Expand Down