[Python] OAuth2 support & refresh-tokens

[khorolets]

Description

Hi! I have a few questions:

1. Is it planned to integrate some sort of support for OAuth2 in that way that it would be auto-generated? If not, would you approve a PR to integrate it?
2. It would be nice to use refresh-tokens to get transparent authorization. So if user makes a request and his token is outdated it would be great to try to renew token with refresh-token to avoid additional error throwing. Can this be integrated into the auto-generated client? Would such feature be merged if a PR is proposed?

[wing328]

@khorolets yes to both.

There were some discussion about these before but we've not seen any PRs from the community so far.

[khorolets]

@wing328
I have found the lib https://github.com/requests/requests-oauthlib which can be used to reach the goal.

Would you merge a PR if it uses requests and requests-oauthlib?

The usage of this libs will add extra dependencies. So we want to bring requests to add oauth2 support but we have no time to refactor the whole python code to use requests instead of urllib3.

/cc @geekerzp

[wing328]

We do have feedback before about avoiding unnecessary dependency if possible, which means owners of a REST API using API key for authentication probably don't want the extra dependencies for oauth2 support.

Let me check a bit more on this and get back to you.

[wing328]

Seems like https://github.com/requests/requests-oauthlib is the most mature and active module for OAuth support in Python.

Another thing we need to consider is that the module needs to work with both python 2.x and 3.x, which should not be a problem for request-oauthlib as its CI tests already cover both python 2.x and 3.x

[krmaxwell]

My sense is that requests in particular is so ubiquitous and well-tested as to be worthwhile in terms of making the code easier to read and maintain. If there were interest in accepting a change to use it more extensively throughout the Python client, I'd be interested in doing the work (assuming nobody else has already got it going, of course!).

[cbornet]

👍 requestsis clearly the best http library in python. Using it would remove a lot of generated boilerplate code.

[frol]

There are some pros and cons.

Pros:

• requests is well-tested and supported
• Adding features like OAuth2/HTTP Auth/Proxy will be easier (I don't see any good OAuth2 client except requests-oauthlib, and it is not fun to reimplement it over urllib3)
• The generated code will be cleaner (I think the rest.py might be removed and api_client.py might become slimmer)

Cons:

• requests adds 3MB in size (mostly due to the vendoring urllib3, chardet, and idna) and I don't think the generated boilerplate cleanup will save us even 1MB
• requests introduce performance overhead compared to urllib3: http://stackoverflow.com/a/32899936/1178806

Neutral:

• requests doesn't have any extra dependencies