如何使用React前端使用IBM App ID在单独的节点服务器上登录？

Question

I want to use IBM app id to perform authentication from a React app using a separate node app. I have verified that authentication is possible when the web pages are served from the the node app (ie my configuration is correct). I'm using the article below as a guide.

My understanding of the flow is as follows: The frontend calls a login api on the backend node server. The node server calls the authorize oauth endpoint which returns (redirects) to the App ID login page to the frontend via the node server.

Is this understanding correct? If so, how is App ID configured (in the node server) to redirect the React frontend to the App ID login page?

https://www.ibm.com/cloud/blog/securing-angularnode-js-applications-using-app-id

Answer 1

I will use FE for your front end and BE for your backend

A user goes to a page on your FE that requires authorization. The FE redirects the user to the App ID authorization URL. The user authenticates with App ID. App ID provides the browser with a code and a redirect URL to go back to your website or any authorized URL. This can be your BE. Your BE processes the code and exchanges it for OAuth tokens (depending on the request: Access Token, Identity Token, Refresh Token). The BE now needs to redirect the user back to your FE.

The problem is that you do not want to pass the OAuth tokens to the FE using the redirect. This means you need another method of the BE calling the FE to pass the tokens for this user.

None of this takes any processing power on your side and consists of very simple code. Review your design to see if you really need to complicate this with FE and BE communication.

Is this understanding correct? If so, how is App ID configured (in the node server) to redirect the React frontend to the App ID login page?

The BE does not redirect the user unless the user is on a web page of the BE. You could call your BE to start the authorization process and have the BE return the redirect URL to the FE, but the page the user is on must send the redirect to the user (for example a button click).