Server-backed flow
Register an exact HTTPS callback. On the backend, generate a new random state and PKCE verifier, derive its S256 challenge, and store the transaction in a short-lived server session tied to the browser. Redirect to https://auth.bhauu.online/oauth/authorize with response_type=code and scope=profile email. At callback, validate state and exchange the code once. Include a server-held client secret only if this registered client uses one; the programming language alone does not make it confidential.
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Facades\Route;
Route::get('/auth/bhauu/start', function (Request $request) {
$verifier = rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '=');
$state = rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '=');
$challenge = rtrim(strtr(base64_encode(hash('sha256', $verifier, true)), '+/', '-_'), '=');
$request->session()->put('bhauu_oauth', compact('state', 'verifier'));
return redirect('https://auth.bhauu.online/oauth/authorize?' . http_build_query(['client_id' => 'YOUR_CLIENT_ID', 'redirect_uri' => 'https://example.com/auth/callback', 'response_type' => 'code', 'scope' => 'profile email', 'state' => $state, 'code_challenge' => $challenge, 'code_challenge_method' => 'S256']));
});
Route::get('/auth/callback', function (Request $request) {
$pending = $request->session()->pull('bhauu_oauth');
abort_unless($pending && hash_equals($pending['state'], (string) $request->query('state')) && $request->query('code'), 400);
$fields = ['grant_type' => 'authorization_code', 'client_id' => 'YOUR_CLIENT_ID', 'code' => $request->query('code'), 'redirect_uri' => 'https://example.com/auth/callback', 'code_verifier' => $pending['verifier']];
// Only for a registered confidential client: $fields['client_secret'] = config('services.bhauu.secret');
$response = Http::asForm()->post('https://auth.bhauu.online/oauth/token', $fields);
abort_unless($response->successful(), 502);
$tokens = $response->json(); // Keep server-side.
abort(501, 'Establish your protected app session before enabling sign-in');
});Complete application sign-in
Use the returned access token with https://auth.bhauu.online/oauth/userinfo if scoped identity claims are needed. Establish an HttpOnly, Secure, SameSite application-session cookie where suitable, with CSRF protection. Clear the pending state and do not expose tokens to templates or logs. Handle local logout and Bhauu-side revocation separately.