title: How to provide frontend with JSON web token after server authentication?
body: <p>So far I have only dealt with server-rendered apps, where after a user logs in via username/password or using an OAuth provider (Facebook etc.), the server just sets a session cookie while redirecting to the relevant page.</p>
  
  <p>However now I'm attempting to build an app using a more 'modern' approach, with React on the frontend and a JSON API backend. Apparently the standard choice for this is to use a JSON web token for authentication, however I'm having trouble working out how I'm meant to provide the JWT to the client so it can be stored in session/local storage or wherever.</p>
  
  <p>Example to illustrate better:</p>
  
  <ol>
  <li><p>User clicks link (<code>/auth/facebook</code>) to log in via Facebook</p></li>
  <li><p>User is redirected and shown Facebook login form and/or permission dialog (if necessary)</p></li>
  <li><p>Facebook redirects user back to <code>/auth/facebook/callback</code> with an authorization code in tow, the server exchanges this for an access token and some information about the user</p></li>
  <li><p>Server finds or creates the user in the DB using the info, then creates a JWT containing a relevant subset of the user data (e.g. ID)</p></li>
  <li><p>???</p></li>
  </ol>
  
  <p>At this point I just want the user to be redirected to the main page for the React app (let's say <code>/app</code>) with the JWT in tow, so the frontend can take over. But I can't think of an (elegant) way to do that without losing the JWT along the way, other than to put it in the query string for the redirect (<code>/app?authtoken=...</code>) - but that will display in the address bar until I remove it manually using <code>replaceState()</code> or whatever, and seems a little weird to me.</p>
  
  <p>Really I'm just wondering how this is typically done, and I'm almost sure I'm missing something here. The server is Node (Koa with Passport), if that helps.</p>
  
  <p>Edit: To be clear, I'm asking what the best way is to provide a token to the client (so it can be saved) <strong>after an OAuth redirect flow</strong> using Passport.</p>