Why This Matters

OAuth is the highest-risk part of Extension development. Token leakage = account compromise. This lesson builds secure auth.

Concept Explained

OAuth flow: user authorizes → Extension gets code → exchanges for access token → uses token for API calls. Store tokens encrypted. Refresh before expiry. Rotate client secrets.

How It Works

Implement standard OAuth 2.0 flow. Store tokens in encrypted secrets manager. Refresh before expiry. Rotate client secrets quarterly. Audit token usage.

Step-by-Step Tutorial

1. Implement OAuth flow

2. Store tokens encrypted

3. Refresh before expiry

4. Rotate client secrets

5. Audit token usage

Real-World Example

A team stored OAuth tokens in plaintext DB. DB backup leaked. Tokens compromised. Lesson: always encrypt tokens; use secrets manager.

Example Prompts / Commands / Code

"""const express = require('express');
const crypto = require('crypto');
const app = express();

const CLIENT_ID = process.env.CLIENT_ID;
const CLIENT_SECRET = process.env.CLIENT_SECRET;
const REDIRECT_URI = 'https://my-extension.example.com/callback';

// Step 1: Redirect user to authorize
app.get('/authorize', (req, res) => {
  const state = crypto.randomBytes(16).toString('hex');
  // Store state in session
  const url = `https://github.com/login/oauth/authorize?client_id=${CLIENT_ID}&redirect_uri=${REDIRECT_URI}&scope=read:catalog&state=${state}`;
  res.redirect(url);
});

// Step 2: Handle callback
app.get('/callback', async (req, res) => {
  const { code, state } = req.query;
  // Verify state matches session

  // Exchange code for token
  const tokenResponse = await fetch('https://github.com/login/oauth/access_token', {
    method: 'POST',
    headers: { 'Accept': 'application/json' },
    body: new URLSearchParams({
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
      code,
      redirect_uri: REDIRECT_URI,
    })
  });
  const tokens = await tokenResponse.json();

  // Store tokens ENCRYPTED in secrets manager
  await secretsManager.storeEncrypted(req.user.id, tokens);

  res.send('Authorized!');
});
"""

Common Mistakes

• Storing tokens in plaintext — leaks are catastrophic.
• Not verifying state parameter — CSRF attacks.
• Not refreshing before expiry — Extension breaks.
• Never rotating client secrets — accumulated risk.

Best Practices

• Implement standard OAuth 2.0 flow.
• Verify state parameter (CSRF protection).
• Store tokens encrypted in secrets manager.
• Refresh before expiry.
• Rotate client secrets quarterly.

Troubleshooting

Practical Exercise

Professional Challenge

Frequently Asked Questions

Further Reading

• GitHub OAuth docs

Official References

• GitHub OAuth
• Building Extensions

Related lessons: PR-21, PR-24