Secure Authentication, Simplified

// B2C Auth — Node.js / Express
// npm install openid-client express-session

const { Issuer, generators } = require('openid-client');

let client;
Issuer.discover('https://auth.ailacs.com').then(issuer => {
    client = new issuer.Client({
        client_id:      process.env.AILACS_CLIENT_ID,
        redirect_uris:  ['https://yourapp.com/callback'],
        response_types: ['code'],
    });
});

app.get('/login', (req, res) => {
    const codeVerifier       = generators.codeVerifier();
    req.session.codeVerifier = codeVerifier;
    req.session.state        = generators.state();
    res.redirect(client.authorizationUrl({
        scope:                 'openid profile email',
        state:                 req.session.state,
        code_challenge:        generators.codeChallenge(codeVerifier),
        code_challenge_method: 'S256',
    }));
});

app.get('/callback', async (req, res) => {
    const tokenSet = await client.callback(
        'https://yourapp.com/callback',
        client.callbackParams(req),
        { code_verifier: req.session.codeVerifier, state: req.session.state }
    );
    req.session.user = tokenSet.claims();
    res.redirect('/dashboard');
});

# B2C Auth — Python / FastAPI
# pip install authlib fastapi starlette uvicorn

from fastapi import FastAPI, Request, Depends, HTTPException
from fastapi.responses import RedirectResponse
from authlib.integrations.starlette_client import OAuth
from starlette.middleware.sessions import SessionMiddleware
import os

app = FastAPI()
app.add_middleware(SessionMiddleware, secret_key=os.environ['SESSION_SECRET'])

oauth = OAuth()
oauth.register(
    name='ailacs',
    server_metadata_url='https://auth.ailacs.com/.well-known/openid-configuration',
    client_id=os.environ['AILACS_CLIENT_ID'],
    client_kwargs={ 'scope': 'openid profile email', 'code_challenge_method': 'S256' }
)

@app.get('/login')
async def login(request: Request):
    return await oauth.ailacs.authorize_redirect(request, request.url_for('auth_callback'))

@app.get('/callback')
async def auth_callback(request: Request):
    token = await oauth.ailacs.authorize_access_token(request)
    request.session['user'] = token['userinfo']
    return RedirectResponse(url='/dashboard')

def require_auth(request: Request):
    if 'user' not in request.session:
        raise HTTPException(status_code=401)
    return request.session['user']

@app.get('/dashboard')
async def dashboard(user=Depends(require_auth)):
    return {'message': f"Hello, {user['name']}"}

// B2C Auth — Java / Spring Boot 3
// application.yml:
// spring.security.oauth2.client.registration.ailacs:
//   client-id: ${AILACS_CLIENT_ID}
//   client-authentication-method: none  # public client — PKCE only
//   authorization-grant-type: authorization_code
//   redirect-uri: "{baseUrl}/login/oauth2/code/ailacs"
//   scope: openid,profile,email
// spring.security.oauth2.client.provider.ailacs:
//   issuer-uri: https://auth.ailacs.com

@Configuration @EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/", "/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                .defaultSuccessUrl("/dashboard", true)
            );
        return http.build();
    }
}

// B2C Auth — Go
// go get github.com/coreos/go-oidc/v3/oidc golang.org/x/oauth2

var (
    provider   *oidc.Provider
    oauth2Conf oauth2.Config
    verifier   *oidc.IDTokenVerifier
)

func init() {
    ctx := context.Background()
    provider, _ = oidc.NewProvider(ctx, "https://auth.ailacs.com")
    verifier    = provider.Verifier(&oidc.Config{ClientID: "your-client-id"})
    oauth2Conf  = oauth2.Config{
        ClientID:    "your-client-id",
        RedirectURL: "https://yourapp.com/callback",
        Endpoint:    provider.Endpoint(),
        Scopes:      []string{oidc.ScopeOpenID, "profile", "email"},
    }
}

func loginHandler(w http.ResponseWriter, r *http.Request) {
    cv := oauth2.GenerateVerifier()
    http.SetCookie(w, &http.Cookie{Name: "pkce_v", Value: cv, HttpOnly: true, Secure: true})
    http.Redirect(w, r, oauth2Conf.AuthCodeURL(randomState(),
        oauth2.S256ChallengeOption(cv)), http.StatusFound)
}

func callbackHandler(w http.ResponseWriter, r *http.Request) {
    vc, _ := r.Cookie("pkce_v")
    token, _ := oauth2Conf.Exchange(r.Context(), r.URL.Query().Get("code"),
        oauth2.VerifierOption(vc.Value))
    rawID, _ := token.Extra("id_token").(string)
    idToken, _ := verifier.Verify(r.Context(), rawID)
    var claims struct{ Sub, Name, Email string }
    idToken.Claims(&claims)
    http.Redirect(w, r, "/dashboard", http.StatusFound)
}

<?php
// B2C Auth — PHP / Laravel 11

class AuthController extends Controller
{
    public function login(Request $request)
    {
        $verifier  = bin2hex(random_bytes(32));
        $challenge = rtrim(strtr(base64_encode(
            hash('sha256', $verifier, true)), '+/', '-_'), '=');
        session(['pkce_verifier' => $verifier, 'oauth_state' => bin2hex(random_bytes(16))]);

        return redirect('https://auth.ailacs.com/connect/authorize?' . http_build_query([
            'response_type'         => 'code',
            'client_id'             => config('services.ailacs.client_id'),
            'redirect_uri'          => config('services.ailacs.redirect'),
            'scope'                 => 'openid profile email',
            'state'                 => session('oauth_state'),
            'code_challenge'        => $challenge,
            'code_challenge_method' => 'S256',
        ]));
    }

    public function callback(Request $request)
    {
        abort_unless($request->state === session('oauth_state'), 422);
        $tokens = Http::asForm()->post('https://auth.ailacs.com/connect/token', [
            'grant_type'    => 'authorization_code',
            'code'          => $request->code,
            'redirect_uri'  => config('services.ailacs.redirect'),
            'client_id'     => config('services.ailacs.client_id'),
            'code_verifier' => session('pkce_verifier'),
        ])->json();
        $claims = $this->verifyIdToken($tokens['id_token']);
        Auth::login(User::updateOrCreate(['sub' => $claims['sub']], ['email' => $claims['email']]));
        return redirect('/dashboard');
    }
}

# B2C Auth — Ruby on Rails 7+
# gem 'omniauth-openid-connect', 'omniauth-rails_csrf_protection'

# config/initializers/omniauth.rb
Rails.application.config.middleware.use OmniAuth::Builder do
  provider :openid_connect,
    name:          :ailacs,
    scope:         [:openid, :profile, :email],
    response_type: :code,
    issuer:        'https://auth.ailacs.com',
    discovery:     true,
    pkce:          true,
    client_options: {
      identifier:   ENV['AILACS_CLIENT_ID'],
      secret:       ENV['AILACS_CLIENT_SECRET'],
      redirect_uri: ENV['AILACS_REDIRECT_URI']
    }
end

# app/controllers/sessions_controller.rb
class SessionsController < ApplicationController
  def create
    auth = request.env['omniauth.auth']
    user = User.find_or_initialize_by(sub: auth.uid)
    user.update!(name: auth.info.name, email: auth.info.email)
    session[:user_id] = user.id
    redirect_to dashboard_path
  end

  def destroy
    session[:user_id] = nil
    redirect_to "https://auth.ailacs.com/connect/logout" \
                "?post_logout_redirect_uri=#{CGI.escape(root_url)}"
  end
end

// B2C Auth — TypeScript / React + react-oidc-context
// npm install oidc-client-ts react-oidc-context

// src/auth/authConfig.ts
import { UserManager, WebStorageStateStore } from 'oidc-client-ts';

export const userManager = new UserManager({
    authority:                'https://auth.ailacs.com',
    client_id:                import.meta.env.VITE_AILACS_CLIENT_ID,
    redirect_uri:             `${window.location.origin}/callback`,
    post_logout_redirect_uri: `${window.location.origin}/`,
    response_type:            'code',
    scope:                    'openid profile email',
    // PKCE enabled by default — no client_secret needed
    automaticSilentRenew:     true,
    userStore: new WebStorageStateStore({ store: window.sessionStorage }),
});

// src/main.tsx
import { AuthProvider } from 'react-oidc-context';
ReactDOM.createRoot(document.getElementById('root')!).render(
    <AuthProvider userManager={userManager}><App /></AuthProvider>
);

// src/components/ProtectedRoute.tsx
export function ProtectedRoute({ children }: { children: React.ReactNode }) {
    const auth = useAuth();
    if (auth.isLoading) return <div>Loading...</div>;
    if (!auth.isAuthenticated) { auth.signinRedirect(); return null; }
    return <>{children}</>;
}