title: Implementing Oauth. Where should use be redirected to after authenticating with the third party?
body: <p>This is my first time implementing OAuth, so I'm just trying to wrap my head around the whole flow.</p>
  <p>I'm trying to implement OAuth for <a href="https://stripe.com/docs/connect/express-accounts" rel="nofollow noreferrer">Stripe Connect</a>. So in step 4 you're sending a POST request with your client secret to the Stripe servers, which I assume means your back end will be handling that.</p>
  <p>Want to make sure I'm thinking about this correctly. After the user authenticates with Stripe, they'll be redirected to a link you've provided (with the Auth Code as a param). Are you suppose to redirect back to the front end client and then the front end client sends that Auth Code to your server, which would then send that and the client secret to Stripe? Or would you redirect to some route on your backend which would then take the Auth Code and redirect the user again to the front end client (one less network request)?</p>
  <p>edit: Looking at this <a href="https://github.com/lelylan/simple-oauth2/blob/master/example/microsoft.js" rel="nofollow noreferrer">example</a>. So it seems like the user will actually make a GET request to your server which will redirect them to Stripe and then make another GET request to another route on your server after authenticating.</p>
  <p>edit 2: After some more digging this is what I think I'm going to do:</p>
  <ol>
  <li>User clicks &quot;Connect To Stipe&quot; and the front end client sends a GET request to my server.</li>
  <li>My server uses uuid/v4 to generate a random string and base64 encodes it.</li>
  <li>The unencoded string is saved to my database and the encoded string is appended as a state parameter.</li>
  <li>My server redirects the User to Stripe's Oauth link with the encoded state as a param.</li>
  <li>User authorizes with Stripe and is redirected to a loading page on my front end.</li>
  <li>Front end client sends a POST request to my server with the Auth Code from Stripe and the state.</li>
  <li>My server decodes the state and checks it with the state in the database.</li>
  <li>If the states match, my server sends a POST request to Stripe with the Auth Code and the Client Secret.</li>
  <li>Stripe sends my server a the User's Account Id, which is then stored in their User model of my database.</li>
  </ol>
  <p>edit 3: After having implemented a couple integrations, I'd like to give another update for this question from a couple years ago.</p>
  <p>I would create a state parameter as a uuid, but not encode it. There's no point. I would also store the state parameter in redis/dynamodb and add a ttl expiration parameter of 1min-10min. So the state parameter would be the key and I'd include the userId or tenantId as a value. When the user gets redirected back to my server, I'll fetch the state parameter from my key/value store. If it doesn't exist (or expired), I'd return a 400. Otherwise, I'd continue with the OAuth process.</p>