stevaidis/dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update OAuth2.md

Browse Source
This commit is contained in:
Ste Vaidis 2024-12-15 12:03:56 +02:00
parent 54c8948b21
commit cb8b251dea
1 changed files with 9 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
OAuth2.md
View File

@ -12,21 +12,20 @@ A way for the `user` to tell `google` to give an access token to `xorismesiti.gr
6. **Access Protected Resources**: Use the `access_token` to fetch the user's Google profile and email from `googleapis.com/oauth2`
7. **Token Refresh** (Optional): If the `access_token` expires, use the `refresh token` to get a new `access_token`.
### Summary of Tasks Split Across Frontend and Backend:
***Frontend**
1. Redirect the user to Google's OAuth authorization endpoint.
2. Capture the authorization code after Google redirects back to the frontend.
3. Send the authorization code to the backend for token exchange.
1. **Redirect** the user to Google's OAuth authorization endpoint.
2. **Get** the authorization `code` after Google redirects back to the frontend.
3. **Send** the authorization `code` to the backend for `token` exchange.
**Backend**
1. Handle the token exchange (exchange the authorization code for an access token and refresh token).
2. Optionally fetch user profile data from Google (or other resources) using the access token.
3. Store the tokens securely (in session or a database).
4. Provide a way to refresh the access token if it expires.
5. By splitting the OAuth flow this way, the sensitive details (like the client secret and token exchange) remain secure on the backend, while the frontend handles user interaction.
1. **exchange** the authorization `code` for an `access_token` and `refresh token`
2. **fetch** user profile data from Google (or other resources) using the `access_token`
3. **Store** the `tokens` securely (in session or a database).
4. **Refresh** the `access_token` if it expires.
# 1. [Frontend] Request Authorization code