Server-backed flow
Register an exact HTTPS callback. On the backend, generate a new random state and PKCE verifier, derive its S256 challenge, and store the transaction in a short-lived server session tied to the browser. Redirect to https://auth.bhauu.online/oauth/authorize with response_type=code and scope=profile email. At callback, validate state and exchange the code once. Include a server-held client secret only if this registered client uses one; the programming language alone does not make it confidential.
import { randomBytes, createHash } from 'node:crypto';
const verifier = randomBytes(32).toString('base64url');
const state = randomBytes(32).toString('base64url');
const challenge = createHash('sha256').update(verifier, 'ascii').digest('base64url');
// Save { state, verifier } in a short-lived server session tied to this browser.
const authorize = new URL('https://auth.bhauu.online/oauth/authorize');
for (const [k, v] of Object.entries({ client_id: 'YOUR_CLIENT_ID', redirect_uri: 'https://example.com/auth/callback', response_type: 'code', scope: 'profile email', state, code_challenge: challenge, code_challenge_method: 'S256' })) authorize.searchParams.set(k, v);
// Redirect the browser to authorize.toString().Exchange at the callback
// At callback: compare the received state with the saved session state first.
const body = new URLSearchParams({ grant_type: 'authorization_code', client_id: 'YOUR_CLIENT_ID', code: callbackCode, redirect_uri: 'https://example.com/auth/callback', code_verifier: savedVerifier });
// Only for a registered confidential client: body.set('client_secret', process.env.BHAUU_CLIENT_SECRET);
const response = await fetch('https://auth.bhauu.online/oauth/token', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body });
if (!response.ok) throw new Error('Bhauu token exchange failed');
const result = await response.json(); // Keep tokens server-side.Complete application sign-in
Use the returned access token with https://auth.bhauu.online/oauth/userinfo if scoped identity claims are needed. Establish an HttpOnly, Secure, SameSite application-session cookie where suitable, with CSRF protection. Clear the pending state and do not expose tokens to templates or logs. Handle local logout and Bhauu-side revocation separately.