I received [an email][1] saying GitHub will require token authentication after August 13 2021. I want to ensure I don&#39;t have an interruption of service (push/pull) after this date.
So I logged into GitHub and [created a token][2] for my single repository.

Now I want to use the token to push/pull my repository from GitHub, in Visual Studio Code, which uses Git and the command line, which I have installed on my Mac.

What do I do to add/replace the password from GitHub with the generated token I just created to push/pull from my repository? Can I do it from Visual Studio Code or does it get added from the terminal command line?

  [1]: https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/
  [2]: https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token




How to add a GitHub personal access token to Visual Studio Code

Keycloak refresh token lifetime is 1800 seconds:

&gt; &quot;refresh_expires_in&quot;: 1800 

How to specify different expiration time? In Keycloak admin UI, only access token lifespan can be specified:

[![enter image description here][1]][1]


  [1]: https://i.stack.imgur.com/18KSI.png

How to specify refresh tokens lifespan in Keycloak

Is it necessary to store the personal access token somewhere locally on the machine after generating it in GitHub? 

If yes, is there any preferred way where it could be stored?

Where to store my Git personal access token?

I am trying to implement stateless authentication with JWT for my RESTful APIs.

AFAIK, JWT is basically an encrypted string passed as HTTP headers during a REST call.

But what if there&#39;s an eavesdropper who see the request and *steals the token*?  Then he will be able to fake request with my identity?

Actually, this concern applies to all *token-based authentication*.

How to prevent that? A secure channel like HTTPS?

What if JWT is stolen?

In my react app i am using [axios][1] to perform the REST api requests.

But it&#39;s unable to send the *Authorization* header with the request.

Here is my code:

    tokenPayload() {
      let config = {
        headers: {
          &#39;Authorization&#39;: &#39;Bearer &#39; + validToken()
        }
      }
      Axios.post( 
          &#39;http://localhost:8000/api/v1/get_token_payloads&#39;,
          config
        )
        .then( ( response ) =&gt; {
          console.log( response )
        } )
        .catch()
    }

Here the `validToken()` method would simply return the token from browser storage.

All requests are having a 500 error response saying that 

&gt; The token could not be parsed from the request

from the back-end.

How to send the authorization header with each requests? Would you recommend any other module with react?


  [1]: https://github.com/mzabriskie/axios

Sending the bearer token with axios

I have a program that integrates with the YouTube Live Streaming API. It runs on timers, so its been relatively easy for me to program in to fetch a new Access Token every 50 minutes with a Refresh Token. My question is, why?

When I authenticated with YouTube, it gave me a Refresh Token. I then use this refresh token to get a new Access Token about once an hour. If I have the Refresh Token, I can ALWAYS use this to get a new Access Token, since it never expires. So I don&#39;t see how this is any more secure than just giving me an Access Token from the start and not bothering with the whole Refresh Token system.

What is the purpose of a &quot;Refresh Token&quot;?

Section 4.2 of the draft OAuth 2.0 protocol indicates that an authorization server can return both an `access_token` (which is used to authenticate oneself with a resource) as well as a `refresh_token`, which is used purely to create a new `access_token`:

https://www.rfc-editor.org/rfc/rfc6749#section-4.2

Why have both? Why not just make the `access_token` last as long as the `refresh_token` and not have a `refresh_token`?

Why Does OAuth v2 Have Both Access and Refresh Tokens?

I&#39;m working with ASP.NET Core application. I&#39;m trying to implement Token Based Authentication but can not figure out how to use new [Security System][1] for my case.
I went through [examples][2] but they didn&#39;t help me much, they are using either cookie authentication or external authentication (GitHub, Microsoft, Twitter). 

What my scenario is: angularjs application should request `/token` url passing username and password. WebApi should authorize user and return `access_token` which will be used by angularjs app in following requests.

I&#39;ve found great article about implementing exactly what I need in current version of ASP.NET - [Token Based Authentication using ASP.NET Web API 2, Owin, and Identity][3]. But it is not obvious for me how to do the same thing in ASP.NET Core.

My question is: how to configure ASP.NET Core WebApi application to work with token based authentication?

  [1]: https://github.com/aspnet/Security
  [2]: https://github.com/aspnet/Security/tree/dev/samples
  [3]: http://bitoftech.net/2014/06/01/token-based-authentication-asp-net-web-api-2-owin-asp-net-identity/

Token Based Authentication in ASP.NET Core

I am currently developing a REST-API which is HTTP-Basic protected for the development environment. As the real authentication is done via a token, I&#39;m still trying to figure out, how to send two authorization headers.

I have tried this one:

    curl -i http://dev.myapp.com/api/users \
      -H &quot;Authorization: Basic Ym9zY236Ym9zY28=&quot; \
      -H &quot;Authorization: Bearer mytoken123&quot;

I could for example disable the HTTP-Authentication for my IP but as I usually work in different environments with dynamic IPs, this is not a good solution. So am I missing something?

Basic HTTP and Bearer Token Authentication

I have used the refresh token several times in just a short period for testing purposes, but I wonder whether Google refresh tokens ever expire? Can I use the same refresh token to get another access token again and again for a long period (a week or even months)?

Do Google refresh tokens expire?

I have a Facebook Page that I want to get some things from it. First thing are feeds and from what I read they are public (no need for access_token). But I want to also get the events... and they aren&#39;t public and need the access_token.

I don&#39;t want the user to login in Facebook or anything like that. I just want to push all the data I can from this only page. That&#39;s why I already discarded many examples I found here and the one at https://developers.facebook.com/blog/post/500/ , because they want the user to login or require some user action I&#39;m not interessed.

What I want is that my Facebook Application have full authorization and access_token to push the data from this one Facebook Page that I own (admin). Is this possible? I already tried many things but nothing seems to work.

I tried clicking at this: https://www.facebook.com/dialog/oauth?client_id=150635421702954&amp;redirect_uri=http://MY_URL/&amp;scope=manage_pages&amp;response_type=token&amp;fields=access_token - changing MY_URL to my site&#39;s and it requests authorization to edit every page I own. Even not being what I want I clicked but had no access_token in return...


Facebook Access Token for Pages

I am trying to get an API query into python. The command line


    curl --header &quot;Authorization:access_token myToken&quot; https://website.com/id


gives some json output. `myToken` is a hexadecimal variable that remains constant throughout. I would like to make this call from python so that I can loop through different ids and analyze the output. Any ideas? Before authentication was needed I have done that with `urllib2`. I have also taken a look at the `requests` module but couldn&#39;t figure out how to do that. 

Many thanks.


python request with authentication (access_token)

I&#39;ve been playing around with the Google Analytics API (V3) and have run into som errors. Firstly, everything is set up correct and worked with my testing account. But when I want to grab data from another profile ID (Same Google Accont/GA Account) I get an 403 Error. The strange thing is that data from some GA accounts will return data whilst other generate this error.

I&#39;ve revoked the token and authenticated one more time, and now it seems like I can grab data from all of my accounts. Problem solved? Not. As the access key will expire, I will run into the same issue again.

If I have understood things right, one could use the resfreshToken to get a new authenticationTooken.

The problem is, when I run: 

    $client-&gt;refreshToken(refresh_token_key) 

the following error is returned:

    Error refreshing the OAuth2 token, message: &#39;{ &quot;error&quot; : &quot;invalid_grant&quot; }&#39;

I’ve checked the code behind the refreshToken method and tracked the request back to the “apiOAuth2.php” file. All parameters are sent correctly. The grant_type is hard coded to ‘refresh_token’ within the method, so it’s hard for me to understand what’s wrong. The parameter array looks like this:

    Array ( [client_id] =&gt; *******-uqgau8uo1l96bd09eurdub26c9ftr2io.apps.googleusercontent.com [client_secret] =&gt; ******** [refresh_token] =&gt; 1\/lov250YQTMCC9LRQbE6yMv-FiX_Offo79UXimV8kvwY [grant_type] =&gt; refresh_token )


The procedure is as follows.

    $client = new apiClient();
    $client-&gt;setClientId($config[&#39;oauth2_client_id&#39;]);
    $client-&gt;setClientSecret($config[&#39;oauth2_client_secret&#39;]);
    $client-&gt;setRedirectUri($config[&#39;oauth2_redirect_uri&#39;]);
    $client-&gt;setScopes(&#39;https://www.googleapis.com/auth/analytics.readonly&#39;);
    $client-&gt;setState(&#39;offline&#39;);
    
    $client-&gt;setAccessToken($config[&#39;token&#39;]); // The access JSON object.
    
    $client-&gt;refreshToken($config[&#39;refreshToken&#39;]); // Will return error here


Is this a bug, or have I completely misunderstood something?


 

How to refresh token with Google API client?

I can&#39;t get my refresh token with my code. I can only get my access token, token type etc.,
I have followed some tutorials like putting `access_type=offline` on my login URL:

    echo &quot;&lt;a href=&#39;https://accounts.google.com/o/oauth2/auth?&quot; 
    	. &quot;access_type=offline&amp;client_id=123345555.apps.googleusercontent.com&amp; &quot;
    	. &quot;scope=https://www.googleapis.com/auth/calendar+https://www.googleapis.com/auth/plus.me&amp;response_type=code&amp; &quot;
    	. &quot;redirect_uri=http://www.sample.com/sample.php&amp;state=/profile&#39;&gt;Google&lt;/a&gt;&quot;;



and my fields in getting the access token:


    $fields=array(
        &#39;code&#39;=&gt;  urlencode($authcode),
        &#39;client_id&#39;=&gt; urlencode($clientid),
        &#39;client_secret&#39;=&gt; urlencode($clientsecret),
        &#39;redirect_uri&#39;=&gt; urlencode($redirecturi),
        &#39;grant_type&#39;=&gt; &#39;authorization_code&#39;,
    );


but I can&#39;t get *refresh_token*, just the *access_token*, *token_type*, *id_token* and *expires_in*.






Get refresh token google api

I am getting one JWT encoded access token from my API in response. But I am not able to decode it and get it in JSON format. I tried using the angular2-jwt library for it, but it did not worked. I am writing my code below:

     setXAuthorizationToken(client){
        let requestHeader = new Headers();
        requestHeader.append(&#39;Content-Type&#39;, &#39;application/x-www-form-urlencoded&#39;);
        this.http.post(client.clientURL + &quot;oauth/token&quot;, &#39;grant_type=password&amp;client_id=toto&amp;client_secret=sec&amp;&#39; +  &#39;username=&#39; + client.username
        + &#39;&amp;password=&#39; + client.password, {
          headers: requestHeader
        }).map(res=&gt;res.json())
        .subscribe((token) =&gt;{
          if(!token.access_token){
              return;
          }
          else{
           var decompressToken = LZString.decompressFromEncodedURIComponent(token.access_token);
           console.log(decompressToken);
    }
        });
        }

Can anybody please help me solve this issue?

How to decode the JWT encoded token payload on client-side in angular?

I&#39;m referencing another SO post that discusses using refresh tokens with JWT.

[JWT (JSON Web Token) automatic prolongation of expiration][1]

I have an application with a very common architecture where my clients (web and mobile) talk to a REST API which then talks to a service layer and data layer.

[![enter image description here][2]][2]

I understand JWT token authentication, but I am a little confused at how I should use refresh tokens.

I want my JWT authentication to have the following properties:

 1. JWT Token has an expiration of 2 hours.
 
 2. The token is refreshed every hour by the client.

 1. If the user token is not refreshed (user is inactive and the app is not open) and expires, they will need to log in whenever they want to resume.

I see a lot of people claiming to make this a better experience using the concept of a refresh token, however, I don&#39;t see the benefit of this. It seems like an added complexity having to manage it.

My questions are the following:

 1. If I WERE to use a refresh token, wouldn&#39;t it still be beneficial to have a long term expiration for good practice on that token as well?
 2. If I WERE to use a refresh token, would that token be persisted with the userId and/or JWT token?
 3. When I update my token every 1 hour, how does this work? Will I want to create an endpoint that takes in my JWT token or my refresh token? Will this update the expiration date of my original JWT token, or create a new token?
 4. Is there the need for a refresh token given these details? It seems that If the user is just using a JWT token to grab a new token (per the link above) then the refresh token is obsolete.

  [1]: https://stackoverflow.com/questions/26739167/jwt-json-web-token-automatic-prolongation-of-expiration
  [2]: http://i.stack.imgur.com/4estc.png

Is a Refresh Token really necessary when using JWT token authentication?

I thought that OAuth is basically a token based authentication specification but most of the time frameworks act as if there is a difference between them. For example, as shown in the picture below [Jhipster][1] asks whether to use an OAuth based or a token based authentication. 

Aren&#39;t these the same thing ? What exactly is the difference since both includes tokens in their implementations ?

[![enter image description here][2]][2]


  [1]: https://jhipster.github.io/
  [2]: http://i.stack.imgur.com/vCcXA.png

What is the difference between OAuth based and Token based authentication?

i have to confess i&#39;ve had this question for a very long time, never really understand. 

say auth token is like a key to a safe, when it expires it&#39;s not usable anymore. now we&#39;re given a magic refresh token, which can be used to get another usable key, and another... until the magic key expires. so why not just set the expiration of the auth token as the same as refresh token? why bother at all?

what&#39;s the valid reason for it, maybe a historical one? really want to know. thanks

what&#39;s the point of refresh token?

I&#39;m building an app that allows users to administrate their Facebook Fan Pages. This requires the following two Access Tokens:

 1. A User Access Token
 2. A Page Access Token

I&#39;m quite familiar with User Access Tokens, but not with Page Access Tokens.

Does anybody know how long the Page Access Token remains valid? All I can find on the Facebook website is [this succinct paragraph][1], which doesn&#39;t mention anything about it&#39;s expiry.

Can I assume that if I am requesting the User Access Token with the `offline_access` permission the Page Access Token will also last indefinitely (unless the user changes their password or manually deauthorises my app)?

I&#39;m asking because I want to know how often I should query the Facebook Graph API and acquire Page Access Tokens. Should I simply request them once when the user registers? Or should I request them one each API Call in the event they continuously change? The latter is obviously more taxing!


  [1]: http://developers.facebook.com/docs/reference/api/page/#page_access_tokens

Facebook Page Access Tokens - Do these expire?

I am developing a Web API 2.1 service that needs to authenticate the connecting clients (HTML5/JS clients that I will create and control). Unfortunately, the user information (username, password hashes, roles and much, much more info) is stored in an existing (SQL Server) database to which I only have read access. The Users database table was created 5-6 years ago without any reference to security frameworks, so it&#39;s a completely custom format. I&#39;m not allowed to make any changes to either the data or the database structure.

Inspired by [this article][1], I rolled my own token-based method of authenticating users, but I&#39;m lacking the completeness and (re)assurance of using an established security framework.

Is there a way to integrate an existing framework, e.g. OAuth2, within my current project given the constraints I mentioned above? I don&#39;t know if it makes any difference, but I&#39;m self-hosting using OWIN.

  [1]: http://www.codeproject.com/Articles/630986/Cross-Platform-Authentication-With-ASP-NET-Web-API


Web API token authentication with a custom user database

I want to get the access token from Google.  [The Google API says][1] that to get the access token, send the code and other parameters to token generating page, and the response will be a JSON Object like :

    {
    &quot;access_token&quot; : &quot;ya29.AHES6ZTtm7SuokEB-RGtbBty9IIlNiP9-eNMMQKtXdMP3sfjL1Fc&quot;,
    &quot;token_type&quot; : &quot;Bearer&quot;,
    &quot;expires_in&quot; : 3600,
    &quot;refresh_token&quot; : &quot;1/HKSmLFXzqP0leUihZp2xUt3-5wkU7Gmu2Os_eBnzw74&quot;
    }

However, I&#39;m not receiving the refresh token.  The response in my case is:

    {
     &quot;access_token&quot; : &quot;ya29.sddsdsdsdsds_h9v_nF0IR7XcwDK8XFB2EbvtxmgvB-4oZ8oU&quot;,
    &quot;token_type&quot; : &quot;Bearer&quot;,
    &quot;expires_in&quot; : 3600
    }


  [1]: https://developers.google.com/youtube/2.0/developers_guide_protocol_oauth2#OAuth2_Server_Side_Web_Applications_Flow

Not receiving Google OAuth refresh token

I&#39;ve been struggling to find out what is happening with this.
My scripts were working fine for a bit and suddenly half stopped.

I&#39;m accessing the api and am getting back an access token. With the access token, I can access a users public info just fine. However, when I try to post info to their FB account I get this error.

    Fatal error: Uncaught OAuthException: An active access token must be used to query information about the current user. 

Any idea what is happening here?
I&#39;m also using sessions on my site to keep track of internal user ids. Not sure if my sessions could be causing a problem.


This is my upload script where I&#39;m getting an error.

    require &#39;facebook/src/facebook.php&#39;;
    
    
    // Create our Application instance (replace this with your appId and secret).
    $facebook = new Facebook(array(
      &#39;appId&#39;  =&gt; &#39;12345678&#39;,
      &#39;secret&#39; =&gt; &#39;REMOVED&#39;,
      &#39;fileUpload&#39; =&gt; true, 
      &#39;cookie&#39; =&gt; true,
    ));
    $facebook-&gt;setFileUploadSupport(true); 
    
    $me = null;
    // Session based API call.
    if ($session) {
      try {
        $uid = $facebook-&gt;getUser();
        $me = $facebook-&gt;api(&#39;/me&#39;);
      } catch (FacebookApiException $e) {
        error_log($e);
      }
    }
    
    
    // login or logout url will be needed depending on current user state.
    if ($me) {
      $logoutUrl = $facebook-&gt;getLogoutUrl();
    } else {
      $loginUrl = $facebook-&gt;getLoginUrl();
    }
    
    
    $photo_details = array(&#39;message&#39; =&gt; &#39;my place&#39;);
    $file=&#39;photos/my.jpg&#39;; //Example image file
    $photo_details[&#39;image&#39;] = &#39;@&#39; . realpath($file);
    $upload_photo = $facebook-&gt;api(&#39;/me/photos&#39;, &#39;post&#39;, $photo_details);




facebook Uncaught OAuthException: An active access token must be used to query information about the current user

With a database session token system I could have a user login with a username/password, the server could generate a token (a uuid for example) and store it in the database and return that token to the client. Every request from thereon would include the token and the server would look up whether the token is valid and what user it belongs to.

Using JWT there would be no need to save anything to the database with respect to session/tokens thanks to the combination of the secret key kept on the server and the signed token the client keeps and sends with every request.

This is good but besides saving a database check each request (which would be fast anyway since it&#39;s just checking a hash table) it&#39;s not clear to me what the advantages are of using JWT. Can you anyone familiar with this explain? **Let&#39;s ignore cookies, it&#39;s specifically a database custom token as described above and JWT that I am trying to compare and understand the benefits**.

All Access Token Solutions on Gang of Coders

Total of 23 Access Token Solutions