User-restricted REST API tutorial

apply plugin: 'java'
apply plugin: 'application'

mainClassName = 'com.example.hellodemo.Application'

group = 'com.example'
version = '0.0.1-SNAPSHOT'
sourceCompatibility = '1.8'

repositories {
	mavenCentral()
}

dependencies {
	compile 'org.apache.httpcomponents:httpclient:4.5.13'
}

jar {
	manifest {
		attributes('Main-Class': mainClassName)
	}
	from {
		configurations.compile.collect { it.isDirectory() ? it : zipTree(it) }
	}
}

package com.example.hellodemo;


import org.apache.http.HttpEntity;
import org.apache.http.NameValuePair;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.message.BasicNameValuePair;

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.List;
import java.util.Scanner;
import java.util.stream.Collectors;

public class Application {
    public static void main(String[] args) throws IOException {
        OAuth oAuth = new OAuth();
        oAuth.getCode();
        oAuth.getAccessToken();
    }
}

class OAuth {
    final private String authorizationUri = "https://sandbox.api.service.nhs.uk/oauth2/authorize";  // Authorization code endpoint
    final private String redirectUri = "http://localhost:5000/callback";  // Callback endpoint
    final private String tokenUri = "https://sandbox.api.service.nhs.uk/oauth2/token";  // Get tokens endpoint
    final private String clientId= "your-client-id";  // change to your Client_ID
    final private String clientSecret = "your-client-secret";  // change to your client_secret
    final private String state = "random";

    public void getCode() {
        System.out.println("Open the link below in your browser");
        System.out.println(authorizationUri +
                "?client_id=" + clientId +
                "&redirect_uri=" + redirectUri +
                "&response_type=code" +
                "&state=" + state);
    }

    public void getAccessToken() throws IOException {
        Scanner in = new Scanner(System.in);
        System.out.println("Enter code:");
        String code = in.nextLine();

        HttpPost httpPost = new HttpPost(tokenUri);
        List<NameValuePair> params = new ArrayList<>();
        params.add(new BasicNameValuePair("grant_type", "authorization_code"));
        params.add(new BasicNameValuePair("client_id", clientId));
        params.add(new BasicNameValuePair("client_secret", clientSecret));
        params.add(new BasicNameValuePair("redirect_uri", redirectUri));
        params.add(new BasicNameValuePair("code", code));

        httpPost.setEntity(new UrlEncodedFormEntity(params));

        CloseableHttpClient client = HttpClients.createDefault();
        CloseableHttpResponse response = client.execute(httpPost);
        HttpEntity entity = response.getEntity();

        if (entity != null) {
            InputStream instream = entity.getContent();
            String text = new BufferedReader(
                    new InputStreamReader(instream, StandardCharsets.UTF_8)).lines()
                    .collect(Collectors.joining("\n"));
            System.out.println(text);
            instream.close();
        }

        client.close();
    }
}

using System;
using System.Collections.Generic;
using System.Linq;
using Newtonsoft.Json;
using Microsoft.AspNetCore.WebUtilities;
using System.Web;
using System.Net.Http;
using System.Threading.Tasks;

namespace HelloWorldUserRestrictedAPI
{
    class OAuth
    {
        Random random = new Random();
        private string chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";

        private string AuthorizationUri = "https://sandbox.api.service.nhs.uk/oauth2/authorize";  // Authorization code endpoint
        private string RedirectUri = "http://localhost:5000/callback";  // Callback endpoint
        private string TokenUri = "https://sandbox.api.service.nhs.uk/oauth2/token";  // Get tokens endpoint      
        private string client_id = "Your_Client_Id";  // change to your Client_ID
        private string client_secret = "Your_Client_Secret";  // change to your client_secret
        private string state;
        public void GetCode()
        {
            var _state = new string(Enumerable.Repeat(chars, 16).Select(s => s[random.Next(s.Length)]).ToArray());
            this.state = _state;
            var dictionary = new Dictionary<string, string>()
           {
               {"client_id", client_id},
               {"redirect_uri", RedirectUri },
               {"response_type", "code"},
               {"state", _state}
           };
            string url = QueryHelpers.AddQueryString(AuthorizationUri, dictionary);
            Console.WriteLine("Open link in your browser " + url);
        }

        public async Task GetAccessToken()
        {
            Console.WriteLine("Enter callback url:");
            string CallbackUrl = Console.ReadLine();
            Uri siteUri = new Uri(CallbackUrl);
            string _code = HttpUtility.ParseQueryString(siteUri.Query).Get("code");
            string _state = HttpUtility.ParseQueryString(siteUri.Query).Get("state");

            if (this.state == _state)
            {
                HttpClient client = new HttpClient();
                client.DefaultRequestHeaders.Add("cache-control", "no-cache");
                var dict = new Dictionary<string, string>()
               {
                   {"grant_type", "authorization_code"},
                   {"client_id", client_id},
                   {"client_secret", client_secret},
                   {"redirect_uri", RedirectUri},
                   {"code", _code}
               };
                FormUrlEncodedContent postData = new FormUrlEncodedContent(dict);
                HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Post, TokenUri);
                request.Content = postData;
                var response = await client.SendAsync(request);
                string responseString = await response.Content.ReadAsStringAsync();
                var json = JsonConvert.DeserializeObject(responseString);
                Console.WriteLine(json);
            }
            else
            {
                Console.WriteLine("callback is malformed");
            }
        }
    }

    class Program
    {
        static async Task Main(string[] args)
        {
            OAuth OAuth = new OAuth();
            OAuth.GetCode();
            await OAuth.GetAccessToken();
        }
    }
}

const ClientOAuth2 = require('client-oauth2')
const https = require('https');
const express = require('express')
const app = express()
//const BASE_URL = "https://sandbox.api.service.nhs.uk"
var access_token

app.listen(5000)
console.log("Server running")
const clientId = "Your_Client_Id" //ENTER CLIENT ID CREDENTIALS
const clientSecret = "Your_Client_Secret" //ENTER CLIENT SECRET CREDENTIALS
const client = new ClientOAuth2({
    clientId,
    clientSecret,
    redirectUri: 'http://localhost:5000/callback',
    authorizationUri: 'https://sandbox.api.service.nhs.uk/oauth2/authorize',
    accessTokenUri: "https://sandbox.api.service.nhs.uk/oauth2/token",
    response_type: 'code',
})


app.get('/', (req, res) => {
    var uri = client.code.getUri()
    res.redirect(uri + 'hello')
})

app.get('/callback', (req, res) => {
    client.code.getToken(req.originalUrl).then(token => {
        client.code.Token = token
        access_token = token.accessToken
        res.redirect("http://localhost:5000/profile")
    })
})

app.get('/profile', (req, res) => {
    var option = {
        host: "sandbox.api.service.nhs.uk",
        path: "/hello-world/hello/user",
        headers: {
            'Authorization': "Bearer " + access_token 
        }
    }

    https.get( option, (resp) => {
        var body = '';
        resp.on('data', function(chunk) {
          body += chunk;
        });
        resp.on('end', function() {
          
            res.send(body);
        });
      })
})

import os

from flask import Flask, redirect, request, session, url_for
from flask.json import jsonify
from requests_oauthlib import OAuth2Session

app = Flask(__name__)
app.secret_key = os.urandom(24)

BASE_URL = "https://sandbox.api.service.nhs.uk"
authorize_url = "https://sandbox.api.service.nhs.uk/oauth2/authorize"
access_token_url = "https://sandbox.api.service.nhs.uk/oauth2/token"

# replace "redirect_uri" with callback url,
# which you registered during the app registration
redirect_uri = "http://localhost:5000/callback"

# replace with your api key
client_id = "your_client_id"
# replace with your secret
client_secret = "your_client_secret"


@app.route("/")
@app.route("/login")
def login():
    nhsd = OAuth2Session(client_id=client_id, redirect_uri=redirect_uri)
    authorization_url, state = nhsd.authorization_url(authorize_url)
    # State is used to prevent CSRF, keep this for later.
    session["oauth_state"] = state
    return redirect(authorization_url)


@app.route("/callback", methods=["GET"])
def callback():
    nhsd = OAuth2Session(client_id=client_id, redirect_uri=redirect_uri, state=session["oauth_state"])
    token = nhsd.fetch_token(
       token_url=access_token_url,
       client_secret=client_secret,
       authorization_response=request.url,
    )
    session["oauth_token"] = token
    return redirect(url_for(".profile"))


@app.route("/profile", methods=["GET"])
def profile():
    # Fetching a protected resource using an OAuth 2 token.
    nhsd = OAuth2Session(client_id, token=session["oauth_token"])
    user_restricted_endpoint = jsonify(
       nhsd.get(f"{BASE_URL}/hello-world/hello/user").json()
    )
    return user_restricted_endpoint


if __name__ == "__main__":
    os.environ["FLASK_ENV"] = "development"
    os.environ['OAUTHLIB_INSECURE_TRANSPORT'] = '1'
    app.run(debug=True)