From 41c6d299361d95be3f2b3a1288a4682278f953b3 Mon Sep 17 00:00:00 2001 From: Ste Vaidis Date: Sun, 15 Dec 2024 18:54:42 +0200 Subject: [PATCH] Update OAuth2-Front-Approach.md --- OAuth2-Front-Approach.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/OAuth2-Front-Approach.md b/OAuth2-Front-Approach.md index 89c0b13..03b11af 100644 --- a/OAuth2-Front-Approach.md +++ b/OAuth2-Front-Approach.md @@ -136,10 +136,10 @@ Content-Type: application/json #### 2.2 Backend -1. The backend **receives** the authorization `code` form frontend (Frontend POST at `xorismesiti.gr/api/auth/exchange-token`) +1. The backend **receives** the authorization `code` form the frontend POST at `xorismesiti.gr/api/auth/exchange-token` 2. The backend **POST** Authorization `code` to Google API 3. The Google API respond to backend POST with the tokens `access_token` and `refresh_token` -4. The backend **respond** to frontend with the tokens (respond to frontend POST at `xorismesiti.gr/api/auth/exchange-token`) +4. The backend **response** to frontends POST with the the tokens *Security: The backend never expose the client_secret to the frontend. This step should always be handled on the backend.*