Class GraphQlAuthorizationSession

Namespace

BpNexT.NET.GraphQL.Client.OAuth

Assembly

BpNexT.NET.GraphQL.dll

A pending OAuth 2.0 authorization code flow where the host owns the callback endpoint (e.g. an ASP.NET controller). The SDK handles everything else: PKCE, state, the authorize URL, callback validation, and the code exchange.

// 1. Start: redirect the user's browser to session.AuthorizeUrl
var session = oauthClient.BeginAuthorization("https://myapp.example/oauth/callback");

// 2. Your callback controller receives the redirect and completes the flow:
var tokens = await session.CompleteAsync(callbackUrl);

The session holds no server connection — it is plain state. For multi-instance web hosts, persist CodeVerifier and State (e.g. in the user's session store) and rebuild the session in the callback request via the public constructor.

public sealed class GraphQlAuthorizationSession

Inheritance

object

GraphQlAuthorizationSession

Constructors

GraphQlAuthorizationSession(OAuthAuthorizationCodeClient, string, string, string, string)

Reconstructs a session from persisted values — for hosts where the callback request may be served by a different process than the one that started the flow.

public GraphQlAuthorizationSession(OAuthAuthorizationCodeClient oauthClient, string codeVerifier, string state, string redirectUri, string scope = "graphql")

Parameters

oauthClient OAuthAuthorizationCodeClient

The protocol client.

codeVerifier string

The persisted PKCE code verifier.

state string

The persisted state value.

redirectUri string

The redirect URI the flow was started with.

scope string

The scope the flow was started with.

Properties

AuthorizeUrl

The full authorization URL to send the user's browser to.

public string AuthorizeUrl { get; }

Property Value

string

CodeVerifier

The PKCE code verifier. Persist it (server-side, never in the browser) when the callback may be handled by another process.

public string CodeVerifier { get; }

Property Value

string

RedirectUri

The redirect URI this flow was started with.

public string RedirectUri { get; }

Property Value

string

Scope

The requested scope.

public string Scope { get; }

Property Value

string

State

The CSRF state value the callback is validated against.

public string State { get; }

Property Value

string

Methods

CompleteAsync(string, string?, CancellationToken)

Completes the flow from already-extracted callback parameters: validates the state and exchanges the code for tokens.

public Task<GraphQlTokenSet> CompleteAsync(string code, string? state, CancellationToken cancellationToken = default)

Parameters

code string

The authorization code from the callback.

state string

The state from the callback.

cancellationToken CancellationToken

Token to cancel the exchange.

Returns

Task<GraphQlTokenSet>

Exceptions

GraphQlAuthenticationException

Thrown when the state does not match or the exchange is rejected.

CompleteAsync(string, CancellationToken)

Completes the flow from the full callback URL (or just its query string) the host's callback endpoint received: surfaces server errors, validates the state, and exchanges the code for tokens.

public Task<GraphQlTokenSet> CompleteAsync(string callbackUrl, CancellationToken cancellationToken = default)

Parameters

callbackUrl string

The full redirect URL or its query string (with or without leading '?').

cancellationToken CancellationToken

Token to cancel the exchange.

Returns

Task<GraphQlTokenSet>

Exceptions

GraphQlAuthenticationException

Thrown when the callback carries an error, the state does not match, the code is missing, or the exchange is rejected.