10

I want to make a small app that gets some account information from Paypal and shows that in a HTML page. I solely use HTML/CSS and Javascript, I dislike to run the authorization flow on the server for security implications. I don't want to have the token on the server.

I have a working setup now using the OAuth code grant flow provided by Paypal (more here), but as described above, I want to cut the server out of the picture.

There are some methods described in the page I just referenced, but none seem to implicate there is an implicit grant possible.

Is it possible to use Paypal with OAuth implicit grant or something similar?

(The current answers are taking the code grant flow, which was specifically not what I asked for. I know that one exists, but it is bad to use it in this case, so please only answer if you know a method without the need to provide the OAuth secret token to the client.)

Jham
  • 195
  • 12
  • Of course this is posible with plain JS. Without any "server side". Have you check this? https://developer.paypal.com/docs/integration/direct/make-your-first-call/#get-an-access-token Is there something you don't understand? – k1r0s May 05 '17 at 08:31
  • What would require my Javascript app to ask the username and password from the user itself. It isn't really the flow I want to follow. They should enter it at the OAuth endpoint, not in my app. @k1r0s – Jham May 05 '17 at 09:07
  • yeah, and then -> (pasted from paypal docs) `After the user grants consent, PayPal redirects (HTTP 302) the user to the return URL with an authorization code appended to the URL. Use the authorization code to get a refresh token and initial access token.` – k1r0s May 05 '17 at 09:13
  • If my answer is still not enough I'll try to achieve the whole process on my own at home with paypal sandbox in order to show you – k1r0s May 05 '17 at 09:15
  • That is about the code grant flow, see my comments on your answer why that is wrong and explicit not an option in my question. – Jham May 05 '17 at 09:15

1 Answers1

2

If anyone does not understand what is/how works Implicit grant

Of course this is posible with plain Javascript but is not recommendable. Paypal has an endpoint to provide auth tokens:

https://developer.paypal.com/docs/integration/direct/make-your-first-call/#get-an-access-token

Also you will need to obtain user's consent.. When performing the request you should provide redirect_uri param with your webapp url. Usually developers tend to store returned values on the server script that receives that response from paypal. But it is not necessary coz you are able to read javascript global var location which contains all params.

Here is an overview of how the OAuth 2.0 auth flow works:

How PayPal uses OAuth 2.0

EDIT:

In order to achieve this you have to do the following steps:

VARIABLES:

  • APP_CLIENT_ID -> your app's client_id
  • APP_SECRET -> your app's secret code
  • APP_RETURN_URL -> default endpoint of your app MUST BE equals to redirect_uri
  • OPEN_ID -> returned code that allows to create a token for specific customer, also to retrieve info from the user

Asuming that you've created an APP in developer.paypal site to obtain "client_id" and "secret" in order to build an url to redirect the user to paypal login form.

  1. Redirect your customer to:

https://www.[sandbox.]paypal.com/signin/authorize?client_id=APP_CLIENT_ID&response_type=token&scope=openid&redirect_uri=APP_RETURN_URL

  1. Customer will log in its account and produce a openid that it will be sent back to your app through http: 302 redirect to redirect_uri which should be your app.

APP_RETURN_URL?code=OPEN_ID&scope=openid

  1. back in your app you can use that code to perform a request to create a token.. and is up to you:

You're able to retrieve profile data from the user such as address, phone..

request: curl -v https://api.sandbox.paypal.com/v1/oauth2/token -H "Accept: application/json" -H "Accept-Language: en_US" -H "Authorization: Bearer OPEN_ID" -u "APP_CLIENT_ID:APP_SECRET" -d "grant_type=client_credentials"

response: {"scope":"https://uri.paypal.com/services/identity/proxyclient https://uri.paypal.com/services/subscriptions https://api.paypal.com/v1/payments/.* https://api.paypal.com/v1/vault/credit-card https://uri.paypal.com/services/applications/webhooks openid https://uri.paypal.com/payments/payouts https://api.paypal.com/v1/vault/credit-card/.* https://uri.paypal.com/services/identity/grantdelegation","nonce":"2017-05-05T14:33:28Z488Zx8aUM1aSVo_wpq8IOecfccJMHptR1PVO2OpWcbA","access_token":"A21AAHZCMP5vBuLMzz2m78DJGZhhpmu854amEVEO5WOavfk1GlNl_gmjSi01_69tJLRi5N_6pT-3GpRqZ81_pD1qKIAGANHMQ","token_type":"Bearer","app_id":"APP-80W284485P519543T","expires_in":32400}

  1. Then you're able to follow this: https://developer.paypal.com/docs/integration/direct/make-your-first-call/#make-an-api-call
k1r0s
  • 359
  • 3
  • 14
  • The first authentication isn't OAuth. It requires the app to ask the user the username and password themselves, something you really don't want to do. The second part of your answer is the code grant flow, which requires a server, which was explicitly not what I want as in my question. The documentation is ambiguous at best, plain wrong in other cases. – Jham May 05 '17 at 09:14
  • 1
    Thanks for your time though. – Jham May 05 '17 at 09:15
  • I don't even think you need a server, rly :\ – k1r0s May 05 '17 at 09:16
  • Yes, since the client_secret should reside on the server as per the OAuth requirements. – Jham May 05 '17 at 09:17
  • Indeed, not going to work from Javascript. That is an absolute no-go. – Patrick Hofman May 05 '17 at 09:17
  • ill try at home. Agree that my answer is not enough clear. – k1r0s May 05 '17 at 09:18
  • I fact, you need a server if you want to hide your app "secret" key. But you can store in browsers memory once you loaded your webapp. But, ofc this isn't a good practice at all – k1r0s May 05 '17 at 09:26
  • That is why you need implicit grant @k1r0s – Patrick Hofman May 05 '17 at 09:29
  • I have checked more in deep. Paypal docs are a mess. There are many places where concepts or params names are incorrect or missplaced. However paypal API still works and follows OAuth guidelines. So you don't have to ask or store customer credentials. (check answer update) – k1r0s May 05 '17 at 14:18
  • That is the code grant flow which requires the client secret. That is meant to be secret and not to be placed in code accessible by the user. – Patrick Hofman May 06 '17 at 11:51
  • yeah, use a proxy server of your own! you cannot do this 100% client side. I mean, you can do this 100% js, but is up to you. but not recommendable. All though my answer is correct. You dont have to deal with user / password. And is still the best way to do. – k1r0s May 06 '17 at 13:18
  • @k1r0s Please remove your answer since it is not useful at all to my question. – Jham Oct 09 '17 at 13:45