Use oauth2 with Lucee

March 18,2023
Tagged Lucee, Coldfusion, oauth2

Lately, I had to implement OAuth2 to an application. I checked if Lucee also offered an integrated function for that, like ColdFusion does. Unfortunately, Lucee does not have this "OAuth2" functionality integrated yet, and thus I had to find another option to get this working. After some research, I found a handy CFC on GitHub which allowed me to easily authenticate with OAuth2.

It is straightforward to incorporate this CFC into your application, and it provides a wide array of different providers. If you need to add a custom Provider, as I did, simply make a few minor modifications to the template and add it to your application.

Here I have an example of a custom provider CFC:

component extends="oauth2" accessors="true" {

	property name="client_id" type="string";
	property name="client_secret" type="string";
	property name="authEndpoint" type="string";
	property name="accessTokenEndpoint" type="string";
	property name="redirect_uri" type="string";

	/**
	* I return an initialized anilist object instance.
	* @client_id The client ID for your application.
	* @client_secret The client secret for your application.
	* @redirect_uri The URL to redirect the user back to following authentication.
	**/
	public anilist function init(
		required string client_id,
		required string client_secret,
		required string redirect_uri
	)
	{
		super.init(
			client_id           = arguments.client_id,
			client_secret       = arguments.client_secret,
			authEndpoint        = 'https://anilist.co/api/v2/oauth/authorize',
			accessTokenEndpoint = 'https://anilist.co/api/v2/oauth/token',
			redirect_uri        = arguments.redirect_uri
		);

		return this;
	}

}

anilist.cfc

And here is another example on how this can be integrated:

<h1>Lucee oauth2 example</h1>

<cfscript>

    // Enter values from the anilist app (No, the keys are not valid.)
    client_id            = "11111"
    client_secret        = "2NG2vpagas253asdafgaqpZnsRK4533fW5x"
    redirect_uri         = "http://localhost/index.cfm"

    anilist = new anilist(client_id, client_secret, redirect_uri);

    // Get URL that the user will click on and grant our application all necessary permissions
    strURL = anilist.buildRedirectToAuthURL();
    echo('<a href="#strURL#">Auth link</a> <br> <br>');

    if(structKeyExists(url, "code")) {

        // Request access token from anilist with the
        // authorization code that we got via the URL
        data = DeserializeJSON(anilist.makeAccessTokenRequest(url.code).content);

        // Print full response from anilist
        dump(var = data, label = "makeAccessTokenRequest - Response from anilist");

        if(isStruct(data)) {
            echo('<a href="./index.cfm?refresh=#data.refresh_token#">Refresh token</a>')
        }

    }

    if(structKeyExists(url, "refresh")) {

        // With the refresh_token we can easly request a new access token
        refreshedToken = DeserializeJSON(anilist.refreshAccessTokenRequest(url.refresh).content);
        dump(var = refreshedToken, label = "refreshAccessTokenRequest - Response from anilist");

        echo('<br> <a href="./index.cfm?refresh=#refreshedToken.refresh_token#">Refresh token</a>')
    }

</cfscript>

index.cfm