Topics created by elliotdickison

@mark-robustelli No worries, we do have a working setup now after a slew of theme tweaks. That said there is still an outstanding question and a possible bug (both low priority).

The question: What happened to the ability to complete an oauth authentication flow by POSTing a code to /oauth2/passwordless? That worked in 1.48.3 but not in 1.55.1.

The potential bug: Why does a GET call to /oauth2/passwordless/<invalid code> redirect the user to the browser confirmation page (even when the request is from the same browser) instead of an invalid code page?

@mark-robustelli This is great, didn't know it existed. We were on an older version of FusionAuth that didn't support the log. Thanks!

@elliotdickison Check out these posts:

179 and 2485

Wonderful blog post. I found it very helpful and informative. Solar

@elliotdickison Thanks for posting!

I shared this internally.

Regarding your first point, I agree a table would of MAU/$ would be helpful.

Regarding your second point, really appreciate that (and the feature suggestions/bug reports you make!). We discuss features and pricing pretty regularly, and I'll surface this comment next time we do so.

@vatsal We did not

@elliotdickison

We typically see the chokepoints for FusionAuth in either the CPU (when doing a lot of password hashing) or the database.

More here: https://fusionauth.io/docs/v1/tech/installation-guide/monitor/#load-testing

Since usage varies, I suggest you perform your own load testing to determine connection limits. Would love to see your conclusions!

@elliotdickison said in Awkward OAuth logout in mobile app:

@maciej-wisniowski We ended up going with your solution and it's working alright, thanks for that!

@robotdan One suggestion for you all: I found the naming of the "AllApplications" value for the application.oauthConfiguration.logoutBehavior setting a bit confusing. As far as I can tell all the "AllApplications" value it really means is "show the OAuth2 logout page". That page can be used to log out of all apps (that's the default template behavior), but it doesn't have to be used that way. Per the suggestion from @maciej-wisniowski we are using the page to log the user out of only one app and show a "successfully logged out" message. Maybe to avoid a breaking API change the value "OneApplication" could be added in addition to "AllApplications" and "RedirectOnly". That value could use the same OAuth 2 logout template but maybe set a variable that could be used to conditionally turn off the logout-of-all-apps behavior. Just a thought.

Thanks for the suggestion @elliotdickison - please do open a GH issue with this suggestion and how you'd like the logout to behave in your use case.

@elliotdickison

Have you had a chance to review our documentation on setting up themes and localization here?

https://fusionauth.io/docs/v1/tech/themes/localization/

Thanks,
Josh

@elliotdickison,

What you are looking for is some of the Auth Flows that we have outlined (pay attention to the recommended ones for a secure setup). Specifically, this one might be helpful.

The common pattern is to have a BFF (backend for frontend) to keep things secure.

We have a nice example of how to securely complete the OAuth handshake in our 5-minute guide, with a section on how to use cookies. I would start there for an overview on how to complete the OAuth handshake using express and nodeJS.
https://fusionauth.io/docs/v1/tech/5-minute-setup-guide#cookies-for-a-single-page-application

I hope this is a good starting point. Let us know if you have other questions.

Thanks,
Josh