I have an API server, and it's SPA client (node+ react, but it's unrelated). All the API endpoints are under
/api namespaces, and the SPA just keep make REST calls to perform operations.
We're working on a feature which require our users to link their Foo Service 3rd party account through OAuth 2. OAuth 2 requires the user to be redirected to the Foo Service auth server, and it'll redirect back, as usual with OAuth 2.
This is where the design question arises:
- I'm making only REST calls through
fetch()in the SPA:
Should the cliente make another REST call, then the server return the usual 302 redirect, and the client would interpret the response, changing the browser to the OAuth 2 website?
Or, should the client know that said request to the server is not to be made through REST, but browser redirect, and then the server just return a 302 heading to Foo Service. If the this one is the correct one, this endpoint shoud not be under
/api path, right?