diff --git a/OAuth2.md b/OAuth2.md index c7b311f..d42847a 100644 --- a/OAuth2.md +++ b/OAuth2.md @@ -1,11 +1,15 @@ +OAuth2 purpose + +A way for the `user` to tell `google` to give an access token to `xorismesiti.gr` app + OAuth2 Flow: -1. **User clicks** "Login with Google" on your platform (xorismesiti.gr). -2. **Authorization Request**: Redirect to Google's authorization endpoint, requesting the user's profile and email. +1. **User clicks** "Login with Google" on your platform `xorismesiti.gr` +2. **Authorization Request**: Redirect to Google's authorization endpoint `accounts.google.com/o/oauth2`, requesting the user's data 3. **User Login and Consent**: User logs in to Google and grants permissions. -4. **Authorization Code Response**: Google redirects back to your platform with an authorization code. +4. **Authorization Code Response**: Google redirects back to your platform `xorismesiti.gr/callback` with an authorization code. 5. **Access Token Request**: Exchange the authorization code for an access token. -6. **Access Protected Resources**: Use the access token to fetch the user's Google profile and email. +6. **Access Protected Resources**: Use the access token to fetch the user's Google profile and email from `googleapis.com/oauth2` 7. **Token Refresh** (Optional): If the token expires, use the refresh token to get a new access token. # 1. Authorization Request (User Initiates Login)