stevaidis/dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update OAuth2.md

Browse Source
This commit is contained in:
Ste Vaidis 2024-12-15 12:03:56 +02:00
parent 54c8948b21
commit cb8b251dea
1 changed files with 9 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
OAuth2.md
View File

@ -12,21 +12,20 @@ A way for the `user` to tell `google` to give an access token to `xorismesiti.gr
6. **Access Protected Resources**: Use the `access_token` to fetch the user's Google profile and email from `googleapis.com/oauth2` 6. **Access Protected Resources**: Use the `access_token` to fetch the user's Google profile and email from `googleapis.com/oauth2`
7. **Token Refresh** (Optional): If the `access_token` expires, use the `refresh token` to get a new `access_token`. 7. **Token Refresh** (Optional): If the `access_token` expires, use the `refresh token` to get a new `access_token`.
### Summary of Tasks Split Across Frontend and Backend: ### Summary of Tasks Split Across Frontend and Backend:
***Frontend** ***Frontend**
1. Redirect the user to Google's OAuth authorization endpoint. 1. **Redirect** the user to Google's OAuth authorization endpoint.
2. Capture the authorization code after Google redirects back to the frontend. 2. **Get** the authorization `code` after Google redirects back to the frontend.
3. Send the authorization code to the backend for token exchange. 3. **Send** the authorization `code` to the backend for `token` exchange.
**Backend** **Backend**
1. Handle the token exchange (exchange the authorization code for an access token and refresh token). 1. **exchange** the authorization `code` for an `access_token` and `refresh token`
2. Optionally fetch user profile data from Google (or other resources) using the access token. 2. **fetch** user profile data from Google (or other resources) using the `access_token`
3. Store the tokens securely (in session or a database). 3. **Store** the `tokens` securely (in session or a database).
4. Provide a way to refresh the access token if it expires. 4. **Refresh** the `access_token` if it expires.
5. By splitting the OAuth flow this way, the sensitive details (like the client secret and token exchange) remain secure on the backend, while the frontend handles user interaction.
# 1. [Frontend] Request Authorization code # 1. [Frontend] Request Authorization code