This is a contributors guide and NOT a user guide. Please visit these docs if you are using or evaluating SuperTokens.

Not support OAuth w/ header-based auth initially

This is just a proposal so far, it hasn't been accepted and needs further discussion.

Context and Problem Statement#

Header-based auth requires a separate implementation using frontend redirection.

Chosen option: Not support OAuth w/ header-based auth initially

Faster first version
We can easily add this later
We are OK with not supporting header-based auth (at least initially) since we think that it'll be a very rare usecase

Same implementation for cookie and header based auth

Goes somewhat against the recommendations (some security concerns)

Very slow - even if the session exists and no auth is required, the full react app would have to load before we can do anything

Supports all usecases

Faster if using cookie-based auth (which is the default/common auth mode)

More implementation time

We can get the first version supporting OAuth2 out faster

We can easily add support later

Limits some use-cases