OAuth 2.0 is a delegated authorization framework. Instead of your app handling passwords, users authenticate with a trusted provider (Google, GitHub, etc.) which issues your app a token.
The flow:
1. User clicks "Sign in with Google"
2. Your server redirects to Google's authorization URL with your client_id and redirect_uri
3. User approves, Google redirects back with a one-time code
4. Your server exchanges the code for an access_token (POST to Google's token endpoint)
5. Your server uses the access_token to fetch the user's profile
GET /auth/google → redirect to provider
GET /auth/google/callback → exchange code for tokenWhy not simulate this end-to-end?
The OAuth redirect flow requires a real browser, a live callback URL (HTTPS), and a registered OAuth application with a provider. These cannot be replicated in a sandboxed environment.
What you should do instead:
Register a GitHub OAuth App at [github.com/settings/developers](https://github.com/settings/developers) with:
Then implement the exchange using the passport library or by hand with node-fetch. The critical security rule: never expose your `client_secret` to the client — the code exchange must happen server-side.
Comprehension check: This lesson is conceptual. Proceed when you can answer:
code and an access_token?redirect_uri do, and why must it be registered with the provider?OAuth 2.0 is a delegated authorization framework. Instead of your app handling passwords, users authenticate with a trusted provider (Google, GitHub, etc.) which issues your app a token.
The flow:
1. User clicks "Sign in with Google"
2. Your server redirects to Google's authorization URL with your client_id and redirect_uri
3. User approves, Google redirects back with a one-time code
4. Your server exchanges the code for an access_token (POST to Google's token endpoint)
5. Your server uses the access_token to fetch the user's profile
GET /auth/google → redirect to provider
GET /auth/google/callback → exchange code for tokenWhy not simulate this end-to-end?
The OAuth redirect flow requires a real browser, a live callback URL (HTTPS), and a registered OAuth application with a provider. These cannot be replicated in a sandboxed environment.
What you should do instead:
Register a GitHub OAuth App at [github.com/settings/developers](https://github.com/settings/developers) with:
Then implement the exchange using the passport library or by hand with node-fetch. The critical security rule: never expose your `client_secret` to the client — the code exchange must happen server-side.
Comprehension check: This lesson is conceptual. Proceed when you can answer:
code and an access_token?redirect_uri do, and why must it be registered with the provider?