Redirect Flow

~3 min

Use the redirect flow when you want the SDK to drive a standard OAuth 2.0 authorization-code redirect cycle for your Express application.

Redirect Flow

Prerequisites

- `express` - `cookie-parser` - an application configured in ThunderID - a redirect route such as `http://localhost:3000/login`

Middleware Order

Mount middleware in this order: 1. `cookie-parser()` 2. `express.json()` if you also need JSON request parsing 3. `thunderID(config)` 4. Route handlers that use `handleSignIn()`, `handleSignOut()`, or `protect()`

Example

index.js

const express = require('express');
const cookieParser = require('cookie-parser');
const {thunderID, handleSignIn, handleSignOut, protect} = require('@thunderid/express');

const app = express();
const port = 3000;

app.use(cookieParser());
app.use(express.json());
app.use(
  thunderID({
    baseUrl: 'https://localhost:8090',
    clientId: '<your-client-id>',
    clientSecret: '<your-client-secret>',
    afterSignInUrl: 'http://localhost:3000/login',
    afterSignOutUrl: 'http://localhost:3000/logout',
  }),
);

app.get('/', (_req, res) => {
  res.send('<a href="/protected">Go to protected page</a>');
});

app.get('/login', handleSignIn());
app.get('/logout', handleSignOut());

app.get(
  '/protected',
  protect((res) => res.redirect('/login')),
  (_req, res) => {
    res.send('You are signed in and can access this protected route.');
  },
);

app.get('/me', protect(), async (req, res) => {
  const user = await req.thunderIDAuth.getUserFromRequest(req);
  res.json(user);
});

app.listen(port, () => {
  console.log(`Server running on http://localhost:${port}`);
});

Flow Lifecycle

1. The user opens a protected route. 2. `protect()` checks the session cookie and current sign-in state. 3. If the request is unauthenticated, your `onUnauthenticated` callback can redirect to `/login`. 4. `handleSignIn()` starts the redirect flow. 5. ThunderID redirects back to the configured sign-in callback route. 6. `handleSignIn()` exchanges the authorization code for tokens and sets the session cookie. 7. Protected routes can now continue and route handlers can read the signed-in user.

Access the Current User

After `thunderID()` runs, the initialized client is available on `req.thunderIDAuth`.

index.js

app.get('/me', protect(), async (req, res) => {
  const user = await req.thunderIDAuth.getUserFromRequest(req);
  res.json(user);
});

Related APIs

- [`thunderID()`](../../apis/middleware/thunderid) - [`handleSignIn()`](../../apis/middleware/handle-sign-in) - [`handleSignOut()`](../../apis/middleware/handle-sign-out) - [`protect()`](../../apis/middleware/protect)