Oauth interaction response type

[muddyfish]

Now we can open oauth prompts in-app, this allows us to add bots to servers without entering the web browser.

This feature request proposes a new response_type which sends a http get request to the specified redirect_uri without redirecting the user there. When used in-app, this would allow a user to make an oauth request without the user leaving the Discord client.

In addition, oauth requests made from the Discord client should be able to spawn an interaction event in the channel so we can do something with the response, assuming it was ran from a guild with the application.commands scope, and receiving the interaction when transferring the code for access tokens. This could alternatively be implemented as an interaction event received over the normal interactions channel with the oauth access token in the event.

This would allow us to power interactions which require one or more scopes only available through oauth. Here are some example commands which could be implemented if this were a feature:

• A modbot which views your connections as server verification without leaving the app, triggered by a URL button
• An upload emote command which allows you to chose which server to upload to if the current guild is full
• A 'Join me to server' button without invite codes, yet still fully in-app

[erkinalp]

When used in-app, this would allow a user to make an oauth request without the user leaving the Discord client

That is against the OAuth specs(see quote below). Could be done in GNAP, once Discord implements a GNAP resource server.

[NovaFox161]

It actually wouldn't. Oauth2's spec for the client is just a set of redirects. Perfectly safe to do that in-app.

As long as the bot/application has a backend server for the actual code exchange, its all within spec.

In fact, MANY apps offer exactly this using webview on android for example.

[erkinalp]

From RFC 8252:

This best current practice requires that native apps MUST NOT use embedded user-agents to perform authorization requests

[Mehgugs]

This wouldn't be an embedded user agent, the proposal is for the discord client to act as the user agent in the oauth2 request, not to embed a browser via something like webview to facilitate authentication.