tauri-plugin-oauth

By setting the redirect_uri field in OauthConfig, the plugin will respond to the OAuth callback with a 302 Found status code to that URL instead of serving an inline HTML response. This is useful for landing the user on a specific page within your application (e.g., a Tauri window URL).

Important Limitation: When redirect_uri is used, the handler closure receives the localhost URL hit by the provider (e.g., http://127.0.0.1:<port>/?code=...), but it does not receive the URL fragment (#...). If your OAuth flow uses an implicit flow where the token is in the fragment, you must parse window.location on the redirected page and manually forward the result back to your app.

let config = OauthConfig {
    redirect_uri: Some("http://tauri.localhost/oauth/done".into()),
    ..Default::default()
};

To develop with Tauri using vanilla HTML, CSS, and TypeScript, it is recommended to use VS Code with the following extensions for optimal development experience:

• VS Code
• Tauri extension (tauri-apps.tauri-vscode)
• rust-analyzer (rust-lang.rust-analyzer)

To use this plugin in your Tauri project, add the dependency to your Rust backend and the corresponding package to your frontend.

Rust (Cargo.toml):

[dependencies]
tauri-plugin-oauth = "2"

TypeScript (npm/yarn):

npm install @fabianlars/tauri-plugin-oauth@2
# or
yarn add @fabianlars/tauri-plugin-oauth@2

You can customize the behavior of the OAuth server using the OauthConfig struct in Rust. This allows you to specify preferred ports, a custom response message, or a redirect URI.

Configuration Options:

• ports: Option<Vec<u16>> - A list of preferred ports to attempt to bind to.
• response: Option<String> - A custom HTML response message to serve to the browser.
• redirect_uri: Option<String> - A URL to which the plugin will issue a 302 Found response after capturing the callback.

use tauri_plugin_oauth::OauthConfig;
use tauri_plugin_oauth::start_with_config;

let config = OauthConfig {
    ports: Some(vec![8000, 8001, 8002]),
    response: Some("OAuth process completed. You can close this window.".into()),
    ..Default::default()
};

start_with_config(config, |url| {
    // Handle OAuth URL
})
.expect("Failed to start OAuth server");

When implementing OAuth with this plugin, follow these security best practices:

1. Validate URLs: Always validate the received OAuth URL on your server-side (the Rust handler) before treating it as authentic.
2. Use HTTPS: Ensure your OAuth flow uses HTTPS to prevent man-in-the-middle attacks.
3. Secure Storage: Implement robust token storage and refresh mechanisms within your application.

The OauthConfig struct allows you to customize the OAuth listener server:

When using tauri-plugin-oauth, you must explicitly grant permissions for the plugin's commands in your Tauri permission configuration. The plugin uses specific identifiers to control access to the start and cancel commands.

Use the allow identifiers to enable functionality and the deny identifiers to restrict it. If no permission is granted, the commands will be inaccessible to the frontend.

| Identifier | Description |
| --- | --- |
| `oauth:allow-cancel` | Enables the cancel command without any pre-configured scope |
| `oauth:deny-cancel` | Denies the cancel command without any pre-configured scope |
| `oauth:allow-start` | Enables the start command without any pre-configured scope |
| `oauth:deny-start` | Denies the start command without any pre-configured scope |

Use the cancel function to stop a running server on a specific port. This sends a special exit signal to the server thread.

Returns Ok(()) if successful, or a std::io::Error if the server could not be reached.

use tauri_plugin_oauth::cancel;

// Stop the server running on port 8080
cancel(8080).expect("Failed to cancel server");

Use the start function to launch a localhost server (binding to 127.0.0.1) to listen for OAuth callbacks. You must provide a closure (handler) that will be executed when a successful connection is made. The handler receives the full URL as a String.

Security Warning: Because the localhost port is unprotected, you must verify the URL inside your handler function to ensure it is the expected callback.

Returns the port number the server is listening on, or a std::io::Error if creation fails.

use tauri_plugin_oauth::start;

// Example usage in Rust
let port = start(|url| {
    println!("Received OAuth callback URL: {}", url);
    // TODO: Verify the URL here for security!
}).expect("Failed to start OAuth server");

println!("Server listening on port: {}", port);

Use start_with_config when you need to customize the server behavior beyond the defaults. You can specify preferred ports, a custom HTML response, or a redirect URI.

Returns the port number the server is listening on, or a std::io::Error if creation fails.

use tauri_plugin_oauth::{start_with_config, OauthConfig};
use std::borrow::Cow;

let config = OauthConfig {
    ports: Some(vec![8080, 8081]),
    response: Some(Cow::Borrowed("<html><body>Auth successful!</body></html>")),
    redirect_uri: Some(Cow::Borrowed("https://myapp.com/callback")),
};

let port = start_with_config(config, |url| {
    println!("Callback URL: {}", url);
}).expect("Failed to start server");