I put my oauth2 flow together and it works, but I think I need to clean it up for the sake of user experience and code integrity. I'm currently using Chrome custom tabs to send the user to the FitBit auth page, but I'm not sure about the best way to handle passing off the authorization code. What I have feels like a work around.
I send the user to the FitBit auth page with a "state" (an option for GET parameters). When FitBit redirects to my server the "state" value also gets sent with it and I put the state and the auth code into a database table. Then client side, I make a request to my server, and retrieve the code associated with the state I just sent.
I feel like I must be over looking something. But I can't find anyway to look at the GET (auth code) data sent along to my redirect url in Chrome custom tabs. Advice would be very much appreciated. Thanks!
