OAuth 2.0 Example

[Mike Stefanik]

I put together an example that shows how to get OAuth 2.0 bearer and refresh tokens and the process involved. You can download it here:

cstools10-dotnet-oauth2-examples.zip

You'll need the current version of SocketTools, and you'll need to make one change to the include file we provide. When I was writing this, I found a bug in one of the function declarations. What's in the include file right now is this:

DECLARE FUNCTION HttpSendResponseW STDCALL LIB "cshtsv10.dll" ALIAS "HttpSendResponseW" ( _
    BYVAL hServer AS DWORD, _
    BYVAL nClientId AS LONG, _
    BYVAL dwOptions AS DWORD, _
    BYVAL lpResponse AS HTTPRESPONSEW, _
    BYREF lpvBuffer AS DWORD, _
    BYVAL dwLength AS DWORD _
) AS LONG

DECLARE FUNCTION HttpSendResponseA STDCALL LIB "cshtsv10.dll" ALIAS "HttpSendResponseA" ( _
    BYVAL hServer AS DWORD, _
    BYVAL nClientId AS LONG, _
    BYVAL dwOptions AS DWORD, _
    BYVAL lpResponse AS HTTPRESPONSEA, _
    BYREF lpvBuffer AS DWORD, _
    BYVAL dwLength AS DWORD _
) AS LONG

And it should be changed to this:

DECLARE FUNCTION HttpSendResponseW STDCALL LIB "cshtsv10.dll" ALIAS "HttpSendResponseW" ( _
    BYVAL hServer AS DWORD, _
    BYVAL nClientId AS LONG, _
    BYVAL dwOptions AS DWORD, _
    BYREF lpResponse AS HTTPRESPONSEW, _
    BYREF lpvBuffer AS DWORD, _
    BYVAL dwLength AS DWORD _
) AS LONG

DECLARE FUNCTION HttpSendResponseA STDCALL LIB "cshtsv10.dll" ALIAS "HttpSendResponseA" ( _
    BYVAL hServer AS DWORD, _
    BYVAL nClientId AS LONG, _
    BYVAL dwOptions AS DWORD, _
    BYREF lpResponse AS HTTPRESPONSEA, _
    BYREF lpvBuffer AS DWORD, _
    BYVAL dwLength AS DWORD _
) AS LONG

The fourth parameter was declared as BYVAL and it should be BYREF. We'll have that fixed for the next update we release, but in the meantime you'll need to edit the CSTOOLS10.INC include file for this example to work correctly.

[Mike Stefanik]

Another thing to keep in mind is that this example will explicitly look for Chrome or Firefox on your system if you have IE as your default browser. Unfortunately, Google no longer supports IE and will throw JavaScript errors if you try to use it when logging in.

One thing I discovered while writing this is there's no great way to force a browser to close its window after you're done with it. They won't accept WM_CLOSE messages sent to their top-level window (WinSpy++ confirms they just ignore the message) and you can't use JavaScript to automatically close a browser window, so going that route won't work. From what I can tell, using TerminateProcess was the only guaranteed way to force the browser window closed, and that's like using a sledgehammer. Chrome will also complain that it wasn't closed properly the next time you open it.

So, this just closes the handles to the process and leaves the browser open. You'll need to close it manually after you've logged in with Google or Microsoft. If someone knows a way to force the browser to close without using TerminateProcess, let me know and I'd be happy to incorporate it into the example..

[Carlo Pagani]

Mike, is it possible to use the browser controls recently published in the forums and then you're in control - I have not looked at your code yet to see if the URL can be managed this way?

[Patrice Terrier]

I have no problem to close Microsoft Edge Canary from an external application.

[Mike Stefanik]

Mike, is it possible to use the browser controls recently published in the forums and then you're in control - I have not looked at your code yet to see if the URL can be managed this way?

As long as the control doesn't use the Trident engine (Internet Explorer) and supports Javascript, I imagine it would be fine. Using an embedded browser is ideal, but that's really a developer choice and what tools they want to use. When Microsoft finishes their work on the WebView2 SDK, I think that'll be the best solution. Chromium based, supported on Windows 7 and later and so on. But right now it's still under development, and requires the Canary build of Edge, which isn't really viable for end-users.

[Mike Stefanik]

I have no problem to close Microsoft Edge Canary from an external application.

Interesting, I hadn't tested the latest Edge with this. My focus was on testing this with Firefox and Chrome, since I figured if people had Edge and were okay with that, they could just use the WebView control. With .NET, the best option short of WebView2 is probably GeckoFX. For ActiveX controls, perhaps WebKitX? I haven't played around with that one.

[Mike Doty]

I just downloaded the 108MB zip file.
If you ever come up with a demo for PowerBASIC or even VB6 without needing a browser and other products it would be appreciated.

[Mike Stefanik]

Desktop apps require interactive authentication by the user. They have to login through Google (or Microsoft) and approve access by your application. That's really the entire point of OAuth 2.0, where the user is granting your app access to their account via the service provider, rather than providing you with their credentials. The ability to "work around" the interactive authentication part and just feed in their account information programmatically would largely defeat the whole purpose.

Edit: It's also worth pointing out that if the user has 2FA enabled, and that's becoming more and more common, it wouldn't be possible at all because it would also require the user provide the "thing they have", like their phone with the Google Authenticator app on it.