Client-Facing OAuth Grant Flow

import crypto from 'crypto';

const AUTHORIZE_URL = 'https://uni.staging.fluzapp.com/authorize';
const REDIRECT_URI = 'https://app.example.com/oauth/finalize'; // one canonical constant

export function buildAuthorizeUrl(session) {
  const state = crypto.randomBytes(32).toString('hex');
  session.oauthState = state; // persist server-side, bound to this session

  const url = new URL(AUTHORIZE_URL);
  url.searchParams.set('response_type', 'code');
  url.searchParams.set('client_id', process.env.FLUZ_CLIENT_ID);
  url.searchParams.set('redirect_uri', REDIRECT_URI);
  url.searchParams.set('state', state);
  url.searchParams.set('external_id', session.userId)

  return url.toString();
}

import os
import secrets
from urllib.parse import urlencode

AUTHORIZE_URL = "https://uni.staging.fluzapp.com/authorize"
REDIRECT_URI = "https://app.example.com/oauth/finalize"  # one canonical constant


def build_authorize_url(session):
    state = secrets.token_hex(32)
    session["oauth_state"] = state  # persist server-side, bound to this session

    params = {
        "response_type": "code",
        "client_id": os.environ["FLUZ_CLIENT_ID"],
        "redirect_uri": REDIRECT_URI,
        "state": state,
        "external_id": session["userId"]
    }
    return f"{AUTHORIZE_URL}?{urlencode(params)}"

package fluz

import (
    "crypto/rand"
    "encoding/hex"
    "net/url"
    "os"
    "strings"
)

const (
    authorizeURL = "https://uni.staging.fluzapp.com/authorize"
    redirectURI  = "https://app.example.com/oauth/finalize"
)

func BuildAuthorizeURL() (authURL string, state string, err error, userId string) {
    b := make([]byte, 32)
    if _, err = rand.Read(b); err != nil {
        return "", "", err
    }
    state = hex.EncodeToString(b) // persist server-side, bound to this session

    u, err := url.Parse(authorizeURL)
    if err != nil {
        return "", "", err
    }

    q := u.Query()
    q.Set("response_type", "code")
    q.Set("client_id", os.Getenv("FLUZ_CLIENT_ID"))
    q.Set("redirect_uri", redirectURI)
    q.Set("state", state)
    q.Set("external_id", userId)
    u.RawQuery = q.Encode()

    return u.String(), state, nil
}

import crypto from 'crypto';

app.get('/oauth/finalize', async (req, res) => {
  const { code, state } = req.query;
  const expected = req.session.oauthState;
  delete req.session.oauthState; // single use, regardless of outcome

  if (!code || !state || !expected) {
    return res.status(400).send('Incomplete authorization response');
  }

  const a = Buffer.from(String(state));
  const b = Buffer.from(String(expected));
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(400).send('State mismatch — request abandoned');
  }

  // Exchange server-side. Never send the code back to the browser.
  const tokens = await exchangeAuthorizationCode(code);
  await persistTokens(req.session.userId, tokens);

  // Trust the returned scope array, not what you requested.
  res.redirect('/settings/connections');
});

import hmac
from flask import request, session, abort, redirect


@app.route("/oauth/finalize")
def oauth_finalize():
    code = request.args.get("code")
    state = request.args.get("state")
    expected = session.pop("oauth_state", None)  # single use

    if not code or not state or not expected:
        abort(400, "Incomplete authorization response")

    if not hmac.compare_digest(state, expected):
        abort(400, "State mismatch - request abandoned")

    # Exchange server-side. Never send the code back to the browser.
    tokens = exchange_authorization_code(code)
    persist_tokens(session["user_id"], tokens)

    # Trust the returned scope array, not what you requested.
    return redirect("/settings/connections")