Tutorial: OAuth

OAuth is an open protocol that aims to standardize the way desktop and web applications access a user's private data. OAuth provides a mechanism for users to grant access to private data without sharing their private credentials (username/password). Many sites have started enabling APIs to use OAuth because of its security and standard set of libraries.

This tutorial will walk you through the necessary steps for creating a Google Chrome Extension that uses OAuth to access an API. It leverages a library that you can reuse in your extensions.

This tutorial uses the Google Documents List Data API as an example OAuth-enabled API endpoint.

Requirements

This tutorial expects that you have some experience writing extensions for Google Chrome and some familiarity with the 3-legged OAuth flow. Although you don’t need a background in the Google Documents List Data API (or the other Google Data APIs for that matter), having an understanding of the protocol may be helpful.

Getting started

First, copy the four library files from the Chromium source tree at .../examples/extensions/oauth_contacts/:

Place the four library files in the root of your extension directory (or wherever your JavaScript is stored). Then include the .js files in your background page in the following order:

<script type="text/javascript" src="chrome_ex_oauthsimple.js"></script>
<script type="text/javascript" src="chrome_ex_oauth.js"></script>
<script type="text/javascript" src="onload.js"></script>

Your background page will manage the OAuth flow.

The OAuth dance in an extension

If you are familiar with the OAuth protocol, you'll recall that the OAuth dance consists of three steps:

  1. fetching an initial request token
  2. having the user authorize the request token
  3. fetching an access token

In the context of an extension, this flow gets a bit tricky. Namely, there is no established consumer key/secret between the service provider and the application. That is, there is no web application URL for the user to be redirected to after the approval process.

Luckily, Google and a few other companies have been working on an OAuth for installed applications solution that you can use from an extension environment. In the installed applications OAuth dance, the consumer key/secret are ‘anonymous’/’anonymous’ and you provide an application name for the user to grant access to (instead of an application URL). The end result is the same: your background page requests the initial token, opens a new tab to the approval page, and finally makes the asynchronous call for the access token.

Setup code

To initialize the library, create a ChromeExOAuth object in the background page:

var oauth = ChromeExOAuth.initBackgroundPage({
  'request_url': <OAuth request URL>,
  'authorize_url': <OAuth authorize URL>,
  'access_url': <OAuth access token URL>,
  'consumer_key': <OAuth consumer key>,
  'consumer_secret': <OAuth consumer secret>,
  'scope': <scope of data access, not used by all OAuth providers>,
  'app_name': <application name, not used by all OAuth providers>
});

In the case of the Documents List API and Google’s OAuth endpoints, a possible initialization may be:

var oauth = ChromeExOAuth.initBackgroundPage({
  'request_url': 'https://www.google.com/accounts/OAuthGetRequestToken',
  'authorize_url': 'https://www.google.com/accounts/OAuthAuthorizeToken',
  'access_url': 'https://www.google.com/accounts/OAuthGetAccessToken',
  'consumer_key': 'anonymous',
  'consumer_secret': 'anonymous',
  'scope': 'https://docs.google.com/feeds/',
  'app_name': 'My Google Docs Extension'
});

To use the OAuth library, you must declare the "tabs" permision in the extension manifest. You must also declare the sites you are using including the request URL, the authorize URL, access URL, and, if necessary, the scope URL. For example: 

"permissions": [ "tabs", "https://docs.google.com/feeds/*",
  "https://www.google.com/accounts/OAuthGetRequestToken",
  "https://www.google.com/accounts/OAuthAuthorizeToken",
  "https://www.google.com/accounts/OAuthGetAccessToken"
]

Fetching and authorizing a request token

Once you have your background page set up, call the authorize() function to begin the OAuth dance and redirect the user to the OAuth provider. The client library abstracts most of this process, so all you need to do is pass a callback to the authorize() function, and a new tab will open and redirect the user. 

oauth.authorize(function() {
  // ... Ready to fetch private data ...
});

You don't need to provide any additional logic for storing the token and secret, as this library already stores these values in the browser’s localStorage. If the library already has an access token stored for the current scope, then no tab will be opened. In either case, the callback will be called.

Sending signed API requests

Once your specified callback is executed, call the sendSignedRequest() function to send signed requests to your API endpoint(s). sendSignedRequest() takes three arguments: a URI, a callback function, and an optional parameter object. The callback is passed two arguments: the response text and the XMLHttpRequest object that was used to make the request.

This example sends an HTTP GET:

function callback(resp, xhr) {
  // ... Process text response ...
};

function onAuthorized() {
  var url = 'https://docs.google.com/feeds/default/private/full';
  var request = {
    'method': 'GET',
    'parameters': {'alt': 'json'}
  };

  // Send: GET https://docs.google.com/feeds/default/private/full?alt=json
  oauth.sendSignedRequest(url, callback, request);
};

oauth.authorize(onAuthorized);

A more complex example using an HTTP POST might look like this:

function onAuthorized() {
  var url = 'https://docs.google.com/feeds/default/private/full';
  var request = {
    'method': 'POST',
    'headers': {
      'GData-Version': '3.0',
      'Content-Type': 'application/atom+xml'
    },
    'parameters': {
      'alt': 'json'
    },
    'body': 'Data to send'
  };

  // Send: POST https://docs.google.com/feeds/default/private/full?alt=json
  oauth.sendSignedRequest(url, callback, request);
};

By default, the sendSignedRequest() function sends the oauth_* parameters in the URL (by calling oauth.signURL()). If you prefer to send the oauth_* parameters in the Authorization header (or need direct access to the generated header), use getAuthorizationHeader(). Its arguments are a URI, an HTTP method, and an optional object of URL query parameters as key/value pairs.

Here is the example above using getAuthorizationHeader() and an XMLHttpRequest object:

function stringify(parameters) {
  var params = [];
  for(var p in parameters) {
    params.push(encodeURIComponent(p) + '=' +
                encodeURIComponent(parameters[p]));
  }
  return params.join('&');
};

function onAuthorized() {
  var method = 'POST';
  var url = 'https://docs.google.com/feeds/default/private/full';
  var params = {'alt': 'json'};

  var xhr = new XMLHttpRequest();
  xhr.onreadystatechange = function(data) {
    callback(xhr, data);
  };
  xhr.open(method, url + '?' + stringify(params), true);
  xhr.setRequestHeader('GData-Version', '3.0');
  xhr.setRequestHeader('Content-Type', 'application/atom+xml');
  xhr.setRequestHeader('Authorization', oauth.getAuthorizationHeader(url, method, params));

  xhr.send('Data to send');
};

Sample code

Sample extensions that use these techniques are available in the Chromium source tree: