I'm new to react/nodejs with oauth2. I'm writing an application where the user should get redirect to /login route on react, which should then pass that to /api/auth/login.
I've written the nodejs/express side. User goes to http://localhost:5000/api/auth/login then are redirected to the oauth2 server for authentication. Once they authenticate, I get back the code and then post the data back to the oauth2 server to get the access_token. Once I have the access_token I perform another post, to get the user details. That flow is how this oauth2 provider is needed. Once I have the user details, I perform a jwt.sign and sign that with a secret. It works as expected.
Now, I'm trying to do this with reacjs. I want the user to go hit the /login route, if they're not authenticated, they go through the process mentioned above. Now...what I don't know exactly how to do is, grab the signed jwt token from express, verify to make sure it's good and then expose the private routes. A lot of the guides I'm seeing are suggesting doing all of this in react, which seems like bad practice because it can expose the client_id and client_secret. How would I be able to do this in terms of best practice and get it functional?