Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p><em>NB: The answer below is applicable mostly to OAuth 1.0</em></p> <p>I don't really know anything about the DevDefined library. But here is a non-technical description of the database design I ended up working with in my latest project, using an SQL database.</p> <p>It should cover everything needed to follow the basic specification. I've tried to keep it down to an absolute minimum.</p> <p><strong>RequestTokens</strong></p> <ul> <li>token (I use an MD5 here, primary key)</li> <li>consumerKey (the unique identifier for the consumer)</li> <li>secret (SHA1)</li> <li>createTime (timestamp)</li> <li>callback</li> </ul> <p><strong>AccessTokens</strong></p> <ul> <li>token (MD5, primary key)</li> <li>secret (SHA1)</li> <li>consumerKey</li> <li>userID (refers to the resource owner)</li> <li>createTime</li> </ul> <p><strong>Consumers</strong> (registered third party applications)</p> <ul> <li>consumerKey (MD5, primary key)</li> <li>consumerSecret (SHA1)</li> <li>userID (refers to the developer who registered the application, not unique)</li> <li>description (a text to describe the application)</li> <li>name (the name of the application)</li> <li>callback</li> </ul> <p><strong>UsedNonces</strong></p> <ul> <li>nonce</li> <li>timestamp </li> </ul> <p>The handling of nonces was really the biggest design question for me. OAuth tells you to never allow the same nonce to be used with the same timestamp ever again. But that would make for an infinitely huge database. I think most providers batch away old nonces at least once in a while.</p> <p>I routinely clear away nonces older than 5 minutes, based on the premise that all requests with a timestamp older than 5 minutes are rejected. I am slightly forgiving when checking timestamps, they need to be UTC and either not older than 5 minutes, and not ahead of my server time more than one minute.</p>
    singulars
    1. This table or related slice is empty.
    1. POwhat is the recommended database structure for OAuth Provider
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USJon Nylander
    1. USJon Nylander
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POwhat is the recommended database structure for OAuth Provider
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTAcceptedByOriginator
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COWhy do you store request token into database while you know it's a temporary token? Isn' it OK to store request tokens in session on server?
      singulars
      1. PO
      1. USMeysam
    2. COThere are no guarantees that either the request token or the access token requests go through a browser. If you only want to support browser based authorization then I guess you could skip persisting the request token. The OAuth specification does not make any assumptions about the type of client (except in the actual authorization step, where a browser is used), but you are free to enforce that of course.
      singulars
      1. PO
      1. USJon Nylander
    3. CODon't you need to store the user ID in the request token too?
      singulars
      1. PO
      1. USJames Billingham
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload