'OAuth2 Authentication Flow - Does client GET my oauth2 server url or open that page in their browser?
I'm trying to write an OAuth2 authentication flow for my site, and currently I can't get past a CORs error. Let's say I want them to go to Discord oauth2 page to authenticate.
Option 1) The current user flow from the browser is making a GET request to my url myserver.com/oauth2. This endpoint on my server redirects to discord oauth2 page. I allowed cors but this option is not working currently and I'm getting a CORS error.
Access to XMLHttpRequest at 'https://discord.com/oauth2/authorize?blahblahblah' (redirected from
'myserver.com/discord/oauth2') from origin 'http://localhost:3000' has been
blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
Option 2) But instead, if I actually make the browser go to my server endpoint myserver.com/discord/oauth2 with an <a> link tag for example, it works. But this seems more janky - takes a few more milliseconds to load.
Question: Is the proper flow to make a GET request to the server and then get redirected (option 1), or is it proper to actually go to the website via an anchor tag for example?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|