Code = from the URL

BarryCarlyon · July 9, 2021, 1:43pm

Users comes to your site
User clicks login butt
User goes to twitch
User comes back to your site
You use the code, you redirect the user to your site.

Like this PHP example

github.com

BarryCarlyon/twitch_misc/blob/main/authentication/user_access_generator/php/index.php#L71

    
      
                  // looks good
                  $_SESSION['token'] = $token;
                  // file_put_contents(__DIR__ . '/auth.json', $r, JSON_PRETTY_PRINT);
          
          
        // login is complete
                  // now we'll redirect home for the "main" viewer
                  // so we can remove the ?code= from the URL
                  // so users can't F5 the page and get an error
                  // since codes are one use
          
          
        header('Location: /');
                  exit;
              } else {
                  $error = 'Failed to parse the JSON at code for token exchange';
              }
          } else {
              // spit out an error
              // we are throwing the result on the end here
              // you wouldn't normally do this in production
              $error = 'An Error Occured at code for token exchange: ' . print_r($r, true);
          }

You can see that if a ?code exists it’s processed, after after processing the user is redirect to / and they never even see the ?code