Authentication and Authorization Setup with Okta

We will look at how to use Okta, a third-party identity provider to set up our authentication and authorization flow.
We will be using react for the frontend single-page application. We will also set up a protected API in Node using Express and Typescript.
We will also look at how to create these applications using the Okta developer portal and how to configure our projects with the correct values so that we are able to have a complete authentication and authorization flow.
Starter project to follow along: github.com/leoroese/node-okta...
Complete project: github.com/leoroese/node-okta...
Timestamps:
0:00 Intro
1:00 Create Okta Account and apps
4:00 SPA config
24:00 Web Server config

[@juanpazmino8645]

This is amazing!! The best video ever!! You saved my life bro!! Thank you!! :)

[@himanshushekhar3694]

terrific video...Thanks so much

[@uzochukwuamarabenneth2583]

Awesome tutorial!!!

[@CodeDunks]

Thank you!

[@palashagrawal4277]

Great Tutorial!! i just wanted to know where we are using client and secret in webserver? because we defined the same in env but i don't see if we are using it.

[@RezaulKarim-bl8gr]

Thank you so much.

[@CodeDunks]

No worries!

[@justdvl]

Thanks

[@arthurmorgan332]

👌👍

[@alanthomasgramont]

Where is the magical post you keep referring to? For some reason I'm not able to find it in your documentation.

[@poornaathreya]

Thank you! I was wondering how you can fix that redirect callback? When you logIn without already being authenticated (at 32:50), it redirects to your Okta dashboard instead of /profile. How do we fix that?

[@georcecostanza]

You just neeed to provide a signin url to Okta. Idk why he configured his that way and then tried to play it off like it was normal lmao

[@Chevindu]

Hey, thanks for the clear video. Small issue: I cannot seem to access your blog. Is the server down, or the domain expired? Thanks.

[@CodeDunks]

Im currently in the process of rebuilding it, forgot to take the link off haha. Thanks for letting me know!

[@geraldomacias7243]

Bummed so much has changed in react-router-dom v6 :(

[@tammycollinse1417]

Hi all, not sure if I will have any luck with this but I am trying to add a flask api authorization (also using okta) with an existing react app that has spa authentication with okta. Is this possible? Any help would be greatly appreciated!

[@abhishekshenoy7638]

I need a help.. I am getting CORS error when I try to test the client part .. something like preflight not allowed for localhost:3000. Could u pls guide

[@AdeshSinghchandel]

Can you help me i try to integrate okta openid auth with private public key how can i do that , when using in react getting error 401 in both react and node js can you guide me usign public key and private key with react and node js i am stuck and no correct documents found

[@stevereid636]

Is the blog post you mentioned back online yet?🙏🏾

[@CodeDunks]

It should be back up soon! Almost done with the rebuilding of it! My apologies

[@ABUTAHER-wg7gz]

hello dear, How can i use SecureRoute in reactrouter 6

[@GetItYND-channel]

Any example for okta+sso,+saml+go

[@sahilroyal8939]

Implicit grant flow should be used for single page allications instead of Authorization code grant flow.

[@CodeDunks]

Just curious where you got this information? Implicit grant flow is a little bit less secure I believe than the Auth code grant flow. Also due to plans for removing third party cookies from browsers auth code is preferred. Here is Microsoft's documentation last updated end of August. docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-implicit-grant-flow

[@bricejoosten5173]

@@CodeDunks Okta themselves teach about implicit flows for SPA and native mobile (native mobile having PKCE too)

[@georcecostanza]

@@bricejoosten5173 - You are incorrect brother. Implicit grant is much less secure. Okta state it in their own docs.

[@gabrielhenton7346]

Everything works for me EXCEPT the Call api button. I triple checked everything but no luck. Any advice?

[@shannonm4238]

I've followed this tutorial to a T and still cannot get the call api button to show anything but unauthorized/401 when I try to hit the protected route from my frontend.

[@aakashrana5969]

@@shannonm4238 any updates on that?