OAuth 2.0 Token Generator with Interactive Playground

const express = require('express');
const crypto = require('crypto');
const jwt = require('jsonwebtoken');

class OAuthServer {
  constructor() {
    this.clients = new Map();
    this.authCodes = new Map();
    this.accessTokens = new Map();
    this.refreshTokens = new Map();
  }

  registerClient(clientId, clientSecret, redirectUris) {
    this.clients.set(clientId, {
      secret: clientSecret,
      redirectUris: new Set(redirectUris)
    });
  }

  generateAuthCode(clientId, userId, scopes) {
    const code = crypto.randomBytes(24).toString('base64url');
    this.authCodes.set(code, {
      clientId,
      userId,
      scopes,
      expiresAt: Date.now() + 10 * 60 * 1000 // 10 minutes
    });
    return code;
  }

  generateTokens(userId, clientId, scopes) {
    const accessToken = crypto.randomBytes(32).toString('base64url');
    const refreshToken = crypto.randomBytes(64).toString('base64url');

    this.accessTokens.set(accessToken, {
      userId,
      clientId,
      scopes,
      expiresAt: Date.now() + 3600 * 1000 // 1 hour
    });

    this.refreshTokens.set(refreshToken, {
      userId,
      clientId,
      scopes,
      expiresAt: Date.now() + 90 * 24 * 3600 * 1000 // 90 days
    });

    return { accessToken, refreshToken, expiresIn: 3600 };
  }

  validateAccessToken(token) {
    const tokenData = this.accessTokens.get(token);
    return tokenData && tokenData.expiresAt > Date.now() ? tokenData : null;
  }
}

const oauthServer = new OAuthServer();

// Register a client
oauthServer.registerClient(
  'client_123456',
  'cs_client_secret_here',
  ['https://example.com/callback']
);

// Authorization endpoint
app.get('/oauth/authorize', (req, res) => {
  const { client_id, redirect_uri, scope, state } = req.query;

  // Validate client and redirect URI
  const client = oauthServer.clients.get(client_id);
  if (!client || !client.redirectUris.has(redirect_uri)) {
    return res.status(400).json({ error: 'invalid_client' });
  }

  // In real implementation, show user consent form
  // For demo, auto-approve
  const authCode = oauthServer.generateAuthCode(client_id, 'user123', scope);

  res.redirect(`${redirect_uri}?code=${authCode}&state=${state}`);
});

// Token endpoint
app.post('/oauth/token', (req, res) => {
  const { grant_type, code, client_id, client_secret, refresh_token } = req.body;

  if (grant_type === 'authorization_code') {
    const codeData = oauthServer.authCodes.get(code);
    if (!codeData || codeData.expiresAt < Date.now()) {
      return res.status(400).json({ error: 'invalid_grant' });
    }

    const tokens = oauthServer.generateTokens(codeData.userId, client_id, codeData.scopes);
    oauthServer.authCodes.delete(code); // One-time use

    res.json({
      access_token: tokens.accessToken,
      token_type: 'Bearer',
      expires_in: tokens.expiresIn,
      refresh_token: tokens.refreshToken,
      scope: codeData.scopes
    });
  }

  // Handle refresh_token grant type...
});

from flask import Flask, request, session, redirect, url_for
import requests
import secrets
from urllib.parse import urlencode

app = Flask(__name__)
app.secret_key = '5Vu3mR43MjAmcMco0h4H45bdjwqiS2ZW5y80UqS3jFM='

# OAuth configuration
OAUTH_CONFIG = {
    'client_id': 'client_123456',
    'client_secret': 'cs_client_secret_here',
    'auth_url': 'https://oauth.provider.com/authorize',
    'token_url': 'https://oauth.provider.com/token',
    'redirect_uri': 'https://example.com/callback',
    'scope': 'read:profile read:email'
}

@app.route('/login')
def login():
    # Generate state for CSRF protection
    state = secrets.token_urlsafe(32)
    session['oauth_state'] = state

    # Build authorization URL
    params = {
        'response_type': 'code',
        'client_id': OAUTH_CONFIG['client_id'],
        'redirect_uri': OAUTH_CONFIG['redirect_uri'],
        'scope': OAUTH_CONFIG['scope'],
        'state': state
    }

    auth_url = f"{OAUTH_CONFIG['auth_url']}?{urlencode(params)}"
    return redirect(auth_url)

@app.route('/callback')
def callback():
    # Verify state parameter
    if request.args.get('state') != session.get('oauth_state'):
        return 'Invalid state parameter', 400

    # Get authorization code
    auth_code = request.args.get('code')
    if not auth_code:
        return 'Missing authorization code', 400

    # Exchange code for tokens
    token_data = {
        'grant_type': 'authorization_code',
        'code': auth_code,
        'client_id': OAUTH_CONFIG['client_id'],
        'client_secret': OAUTH_CONFIG['client_secret'],
        'redirect_uri': OAUTH_CONFIG['redirect_uri']
    }

    response = requests.post(OAUTH_CONFIG['token_url'], data=token_data)

    if response.status_code == 200:
        tokens = response.json()
        session['access_token'] = tokens['access_token']
        session['refresh_token'] = tokens.get('refresh_token')
        return redirect(url_for('profile'))
    else:
        return 'Token exchange failed', 400

@app.route('/profile')
def profile():
    access_token = session.get('access_token')
    if not access_token:
        return redirect(url_for('login'))

    # Make API request with access token
    headers = {'Authorization': f'Bearer {access_token}'}
    response = requests.get('https://api.provider.com/user/profile', headers=headers)

    if response.status_code == 200:
        user_data = response.json()
        return f"Welcome, {user_data.get('name', 'User')}!"
    else:
        # Token might be expired, try refresh
        return refresh_and_retry()

def refresh_and_retry():
    refresh_token = session.get('refresh_token')
    if not refresh_token:
        return redirect(url_for('login'))

    # Refresh access token
    token_data = {
        'grant_type': 'refresh_token',
        'refresh_token': refresh_token,
        'client_id': OAUTH_CONFIG['client_id'],
        'client_secret': OAUTH_CONFIG['client_secret']
    }

    response = requests.post(OAUTH_CONFIG['token_url'], data=token_data)

    if response.status_code == 200:
        tokens = response.json()
        session['access_token'] = tokens['access_token']
        return redirect(url_for('profile'))
    else:
        return redirect(url_for('login'))