OAuth for Desktop apps?

i wonder how do desktop apps without any domain names use oauth? or is it not supposed to be used this way? if so what do i u开发者_Python百科se? say for tumblr they have an authentication api so i will have to put the username and password in the url/query string?

i am thinking of using WPF/Adobe AIR. how does something like tweetdeck work?

---

I've been puzzled by the same question about lack of domain or app url, but it turns out redirection is not the only possible way to complete OAuth authentication process.

I.e., when webapp requests access it provides callback url: the one user will be redirected to when process is completed. That's how webapp know that everything's done.

But you can't redirect to application on user's machine. Thus, there's another way: upon successful authentication server presents special code to the user. Then user copies this code and provides it to application.

You can see both ways described in specification draft.
Also, here's an example of this authentication flow with twitter.

---

It looks like it may be possible, see googles docs on the subject:

https://developers.google.com/identity/protocols/oauth2/native-app

---

For a desktop app where a user needs to authenticate himself, you will usually want to use the Authorization code flow.

The approach goes roughly like this:

1. setup a temporary webserver that listens on the loopback interface
2. present the login page to the user (either in an embedded browser control or an external browser), with the URL of your temporary webserver as redirect_url
3. upon successful login, the user will be redirected to your temporary webserver and you can obtain the access code from the code query parameter
4. Using the access code, you can obtain a token and start making requests using it
5. Shutdown the temporary webserver

Please note that you will have to allow localhost as redirect URL in your identity provider, in ordrer for this approach to work.

For further details, please take a look at these sample apps from Google.

---

You should start by reading about getting started with OAuth. Eventually, even a desktop application will open a browser window to authenticate the user - TweetDeck and other Twitter clients do this, as you've probably noticed.

Tumblr, in your example, doesn't use OAuth but rather basic authentication that is being performed via simple HTTP web requests.

---

Twitter doesn't want users entering their credentials into your application. So at some point the desktop app will need to open a browser window through which Twitter can authenticate their users and return an access token representing the user. From that point the desktop app can use the access token to represent the user in all subsequent API calls to Twitter.

---

In a desktop environment you have another way to get the token, the browser open url itself.

the OAuth2 server will redirect the users browser to the Redirect URL with the token as a query parameter, so if you control the browser used, you can read the the token directly from the url that the user was redirected to.

Graphical libraries like GKT+ have integrated options to create mini browsers that the user can use to authenticate, and it automatically return the token to the app, but other options are possible, like reading Firefox url for example.