Best way to handle OAuth to other services

[xzion]

@trevorhinesley

Pop-ups cannot call back to their opener in this case

Except if you use HTML 5 Web Messaging, in which case it works great.

Here’s a gist of my code (works in 3 live extensions): Twitch OAuth in a popup · GitHub

And here’s some notes on postmessage for reference: Window: postMessage() method - Web APIs | MDN

@trevorhinesley

If #3 can’t happen like that, then how do you go about saving the auth credentials in the EBS and tying it to the proper user on the back-end so that the client-side can retrieve it later, without also having the user ID (either opaque ID or their actual Twitch ID) to associate with the credentials that are sent as parameters in the OAuth callback URL (since the redirect URI can’t have additional parameters that we could supply–because most OAuth schemes don’t allow parameters in the redirect URI or wildcard URLs, it has to match what’s in their whitelist exactly)??

That’s a long sentence.

Hope that helps.