CORS error persists in oAuth even after setting header

BarryCarlyon · December 25, 2020, 12:09pm

But this is a requirement of user oAuth (for any service) you have to leave your site to go to the service site to grant account access.

Depends what you mean by “state”.

If you mean “state” as in the “state parameter for CSRF attack defense”, I store it in the session. And a sessionID cookie is stored on the users computer in order to recall that session

github.com

BarryCarlyon/twitch_misc/blob/main/authentication/user_access_generator/nodejs/server.js#L184


      
                      'Authorization': `Bearer ${req.session.token.access_token}`
                  }
              }
          );
          
          if (userResp.status != 200) {
              req.session.error = 'An Error occured: ' + await tokenResp.text();
              res.redirect('/');
              return;
          }
          
          let userData = await userResp.json();
          // malformed...
          if (!userData.hasOwnProperty('data')) {
              req.session.warning = 'We got a Token but failed to get your Twitch profile from Helix';
              res.redirect('/');
              return;
          }
          // not one user returned
          if (userData.data.length != 1) {
              req.session.warning = 'We got a Token but failed to get your Twitch profile from Helix';