OAuth

// Flujo OAuth 2.0 (Authorization Code) // 1. Usuario hace click en "Login con Google" // 2. Redirigir a Google const authUrl = `https://accounts.google.com/oauth2/auth? client_id=${CLIENT_ID}& redirect_uri=${REDIRECT_URI}& response_type=code& scope=email profile`; window.location.href = authUrl; // 3. Usuario autoriza, Google redirige con código // GET /callback?code=abc123 // 4. Backend intercambia código por token app.get('/callback', async (req, res) => { const { code } = req.query; const tokenResponse = await fetch('https://oauth2.googleapis.com/token', { method: 'POST', body: new URLSearchParams({ code, client_id: CLIENT_ID, client_secret: CLIENT_SECRET, redirect_uri: REDIRECT_URI, grant_type: 'authorization_code' }) }); const { access_token } = await tokenResponse.json(); // 5. Usar token para obtener datos del usuario const userInfo = await fetch('https://www.googleapis.com/oauth2/v2/userinfo', { headers: { Authorization: `Bearer ${access_token}` } }).then(r => r.json()); });