oauth2client

const (
	// DirectAuthURLMode queries the remote proxy to get
	// an auth URL that goes directly to the OAuth2 provider
	// web page the user must go to in order to obtain
	// authorization. Although this mode incurs one extra
	// HTTP request (that is not part of the OAuth2 spec,
	// it is purely our own), it is perhaps more robust in
	// more environments, since the browser will access the
	// auth provider's site directly, meaning that any HTML
	// or JavaScript on the page that expects HTTPS or a
	// certain hostname will be able to function correctly.
	DirectAuthURLMode AuthURLMode = "direct"

	// ProxiedAuthURLMode makes an auth URL that goes to
	// the remote proxy, not directly to the provider.
	// This is perhaps a "purer" approach than
	// DirectAuthURLMode, but it may not work if HTML or
	// JavaScript on the provider's auth page expects
	// a certain scheme or hostname in the page's URL.
	// This mode usually works when the proxy is running
	// over HTTPS, but this mode may break depending on
	// the provider, when the proxy uses HTTP (which
	// should only be in dev environments of course).
	//
	// For example, Google's OAuth2 page will try to set a
	// secure-context cookie using JavaScript, which fails
	// if the auth page is proxied through a plaintext HTTP
	// localhost endpoint, which is what we do during
	// development for convenience; the lack of HTTPS caused
	// the page to reload infinitely because, even though
	// the request was reverse-proxied, the JS on the page
	// expected HTTPS. (See my self-congratulatory tweet:
	// https://twitter.com/mholt6/status/1078518306045231104)
	// Using DirectAuthURLMode is the easiest way around
	// this problem.
	ProxiedAuthURLMode AuthURLMode = "proxied"
)