Menu

play.AJGaming.net Click to Copy

Players Online

  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

OAuth2 Approach to Discord Account Verification

Discussion in 'Denied Suggestions' started by repositories, Aug 13, 2018.

  1. repositories

    Joined:
    Dec 3, 2015
    Messages:
    20
    Likes Received:
    4
    Hello, I find that the current way of getting your donator discord role is kind of hard to follow, leaving many players confused about how to get the role, so I propose a better method of verifying a discord account belongs to a certain user.

    The way I suggest you do it is through Discord's OAuth2 API.

    This is how it would work.

    Full flow:

    1. The player runs a command in game, such as /linkdiscord
    2. The server responds with a Discord OAuth2 code grant URL, with a unique callback URI that corresponds to their minecraft account using the identity scope.
    3. The player signs in using their discord credentials, and authorizes the code grant.
    4. The server uses the code grant in order to grab the player's Discord User ID and assign them the appropriate rows by checking the database that contains what groups the user is in.
    5. Destroy code grant.

    User flow:
    1. Run command ingame
    2. Click Link
    3. Sign in via Discord

    This process makes it easier for the user and should get rid of any confusion on how to obtain the donator role on Discord.
     
    #1
  2. NotMyFault

    NotMyFault The Sanctuary
    Retired Administrator

    Joined:
    Jul 9, 2016
    Messages:
    1,319
    Likes Received:
    824
    If you can describe it that properly and detailed, you may can work out a draft too ;)
     
    #2
  3. repositories

    Joined:
    Dec 3, 2015
    Messages:
    20
    Likes Received:
    4
    I'll make a proof on concept video :)
     
    #3
  4. repositories

    Joined:
    Dec 3, 2015
    Messages:
    20
    Likes Received:
    4
    EDIT: If you encountered any errors, those have been ironed out (hopefully)
    My database exploded.

    UPDATE: I've made an OAuth2 example. Feel free to play with it.
    https://oauth2.stan.host/

    The source code is available here:
    https://github.com/repository/discord-oauth2-example

    You are free to use the code in any way you like.

    Here's how it works:

    1. The user runs a "command", which generates a unique random 32 character string, stored in a database, along with their username. In a real situation, it would be storing their Minecraft UUID.
    2. The user is given a Discord authorization URL, which they click, and authorize our application. The 32 character string is also sent along with the Discord authorization URL as the state query string.
    3. The user is redirected to our callback URI, and we extract the code granted to us by Discord and the 32 character string mentioned earlier, which are both query strings.
    4. We use the code from Discord to query Discord to get a bearer token.
    5. We then use the bearer token to get information about the user's Discord account (their user ID, username, avatar, etc...)
    6. We send a POST request to the bot, which checks the user's in game ranks, and if applicable, assign them a role.

    This doesn't actually check anything, but it's easy to implement.

    Please note that the discord server I have on the website is purely for demonstration purposes, you can't even send messages in it.
     
    #4
    Last edited: Aug 16, 2018