Stable, documented and secure Auth API

[yankovichv]

Colleagues, I would like to know the vision of the group members about API authorization.

It seems to me that a simple authorization API is required by many developers. That being said, it must be safe out of the box.

However, at the moment, with the advent of V3, we are deprived of such a solution. Or is it unknown to me?

1. Firebase does not support extensions on V3.
2. Chrome.Identity is poorly documented and unstable. Developers don't want to work with him.
3. I have already seen a couple of homemade solutions. But it seems to me that a refresh token in a cookie or even in Chrome Storage doesn't look secure enough.

What do you think? What is the best authorization solution at the moment? What is your vision for a better solution in the future? What's the priority?

I would probably be most happy with the support for V3 extensions from the Firebase team. Moreover, it is possible that within the initiative, they could support not only Auth but come up with something else for real-time Firestore sync.

[zombie]

2. Chrome.Identity is poorly documented and unstable. Developers don't want to work with him.

Can you provide more details of why this isn't enough for your use case? Is the documentation on MDN also insufficient?
https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/identity

[yankovichv]

2. Chrome.Identity is poorly documented and unstable. Developers don't want to work with him.

Can you provide more details of why this isn't enough for your use case? Is the documentation on MDN also insufficient? https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/identity

Suppose we are talking about identity.launchWebAuthFlow() method, then at the moment, it is broken.

1. He does not have access to the shared storage of cookies.
2. The cookies that this method creates are session cookies and are deleted when the browser is closed.

Both of these points make the UX of this thread completely unacceptable.

If we are talking about identity.getAuthToken() then

1. This method only works with Google
2. Required documentation is missing. It is not particularly clear how this method behaves offline.
3. This method is broken. Because for some reason, it remembers the account with which the user logged in for the first time and then does not offer an account selection.

We worked with this method for six months but eventually gave up.