Skip to content

Register web client to access the vault #333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Sheikah45 merged 2 commits into from
Oct 5, 2026
Merged

Register web client to access the vault #333

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ffd58a1
Register client for the vault
Garanas Oct 3, 2026
3676a86
Remove the localhost redirect
Garanas Oct 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions apps/ory-hydra/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,3 +166,12 @@ clients:
logoUri: "https://tournaments.doodlepros.com/favicon.svg"
clientUri: "https://tournaments.doodlepros.com"
tokenEndpointAuthMethod: "client_secret_post"

- name: "Web vault by Jip Wijnia"
id: "54576b8e-14bc-473d-9f85-31e6327c9e3b"
grantType: "authorization_code,refresh_token"
scope: "openid,offline,public_profile"
redirectUri: "https://vault.jipwijnia.nl/"
logoUri: "https://vault.jipwijnia.nl/favicon.png"
clientUri: "https://github.com/Garanas/scfa-cs-replay"
tokenEndpointAuthMethod: "none"

@Sheikah45 Sheikah45 Oct 4, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is the auth none? This is a website right so you should have a client secret post. Or is this a purely client side web app.

@Garanas Garanas Oct 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At the moment it is essentially a static website with a very small backend. The backend exists at this stage to circumvent problems with CORS on the /api/oauth/token endpoint and to populate discord, twitter or slack cards with content.

edit: but I could totally miss interpret it. I'm not that familiar with CORS, I just know it exists for good reasons 😃

@Sheikah45 Sheikah45 Oct 4, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does your app use pkce? If not it would be better to use client secret post auth.

@Garanas Garanas Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, see also:

Ideally the tokens would not need to pass through the server. Is there anything I can do to make that part of the website entirely static?

@Sheikah45 Sheikah45 Oct 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh interesting, what issues do you have with CORS?

@Sheikah45 Sheikah45 Oct 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would have thought if it was pure SPA then should be fine all client side.

Loading