Re: OAuth2 implementation in Elisp

[Ted Zlatanov]

On Mon, 26 Sep 2011 17:04:18 +0200 Julien Danjou <address@hidden> wrote: 

JD> When the client is a native client (like Emacs), the user is sent to an
JD> URL where the OAuth provider prints the following:

JD> "The application $REGISTERED-APPLICATION-NAME is trying to access your
JD>  data in $THIS-WAY. Is this OK?

JD>   [YES] [NO]"

JD> If the user clicks yes, an authorization code is printed, the user give
JD> it to Emacs, and Emacs can obtain an access token from the OAuth
JD> provider to access the user data. Point.

You are asking the user to visit a URL (with `browse-url') with an
external web browser that can run Javascript, then maybe they get back
an auth code, and then they paste it back to Emacs.  The way you have
written oauth2.el, anyone that has customized `browse-url' to use w3m or
other non-Javascript browsers will not know that something went wrong.
Maybe oauth2.el should check for that case.

Ted