diff --git a/OAuth2-Front-Approach.md b/OAuth2-Front-Approach.md index 41d3438..5794d2f 100644 --- a/OAuth2-Front-Approach.md +++ b/OAuth2-Front-Approach.md @@ -176,10 +176,10 @@ export default Callback; #### 2.2 Backend -1. The backend **receives** the authorization `code` form the frontend POST at `xorismesiti.gr/api/auth/exchange-token` -2. The backend **POST** Authorization `code` to Google API -3. The Google API respond to backend POST with the tokens `access_token` and `refresh_token` -4. The backend **response** to frontends POST with the the tokens +1. The Backend **receives** the authorization `code` form the Frontend POST at `xorismesiti.gr/api/auth/exchange-token` +2. The Backend **POST** the Authorization `code` to Google API +3. The Google **response** to Backend POST with the tokens +4. The Backend **response** to Frontend POST with the the tokens *Security: The backend never expose the client_secret to the frontend. This step should always be handled on the backend.*