42 OAuth Setup

Overview

BookMe uses 42 Intra OAuth 2.0 for authentication. This provides secure, single sign-on access for Hive Helsinki students and staff.

42 OAuth is the only supported authentication method. Users must have a valid 42 Intra account to access the system.

Create OAuth Application

Access 42 Intra

Navigate to the 42 API applications page:https://profile.intra.42.fr/oauth/applications/newLog in with your 42 Intra credentials.

Create New Application

Fill in the application details:Name: BookMe - Hive Helsinki (or your preferred name)Redirect URI:

http://localhost:8080/oauth/callback

For production, use your production domain:

https://api.yourdomain.com/oauth/callback

Select Scopes

Under Scopes, select:

✅ Access the user public data

This allows the application to read:

User email
Username
Profile information

Save Application

Click Submit to create the application.You’ll receive:

Client ID (UID)
Client Secret (Secret)

Save these credentials immediately. The client secret is only shown once.

Configure Environment Variables

Add your OAuth credentials to .env:

# OAuth Application Credentials
CLIENT_ID=your-42-client-id
SECRET=your-42-client-secret

# Backend OAuth Callback
REDIRECT_URI=http://localhost:8080/oauth/callback

# Frontend Redirect (after successful auth)
REDIRECT_TOKEN_URI=http://localhost:3000/auth/callback

# 42 API Endpoints
OAUTH_AUTH_URI=https://api.intra.42.fr/oauth/authorize
OAUTH_TOKEN_URI=https://api.intra.42.fr/oauth/token
USER_INFO_URL=https://api.intra.42.fr/v2/me

Variable Descriptions

Variable	Description
`CLIENT_ID`	Your 42 OAuth application client ID (UID)
`SECRET`	Your 42 OAuth application client secret
`REDIRECT_URI`	Backend endpoint that handles OAuth callback
`REDIRECT_TOKEN_URI`	Frontend URL to redirect user after login
`OAUTH_AUTH_URI`	42 authorization endpoint (fixed)
`OAUTH_TOKEN_URI`	42 token endpoint (fixed)
`USER_INFO_URL`	42 user info API endpoint (fixed)

OAuth Flow

BookMe implements the standard OAuth 2.0 authorization code flow:

User Initiates Login

Frontend redirects user to:

GET /oauth/login

Redirect to 42

Backend redirects to 42 Intra with:

https://api.intra.42.fr/oauth/authorize?
  client_id=YOUR_CLIENT_ID&
  redirect_uri=http://localhost:8080/oauth/callback&
  response_type=code&
  scope=public

User Authorizes

User logs in at 42 Intra and authorizes the application.

Receive Authorization Code

42 redirects back to:

GET /oauth/callback?code=AUTHORIZATION_CODE

Exchange for Access Token

Backend exchanges authorization code for access token:

POST https://api.intra.42.fr/oauth/token

Fetch User Info

Backend retrieves user profile:

GET https://api.intra.42.fr/v2/me

Create User & JWT

Backend:

Creates or updates user in database
Generates JWT token
Redirects to frontend with token:

http://localhost:3000/auth/callback?token=JWT_TOKEN

Frontend Integration

In your frontend application, create a login button that redirects to:

const handleLogin = () => {
  window.location.href = 'http://localhost:8080/oauth/login';
};

Handle Callback

Create a callback route at /auth/callback to receive the JWT:

// Example: React component
import { useEffect } from 'react';
import { useNavigate, useSearchParams } from 'react-router-dom';

function AuthCallback() {
  const [searchParams] = useSearchParams();
  const navigate = useNavigate();

  useEffect(() => {
    const token = searchParams.get('token');
    if (token) {
      // Store token
      localStorage.setItem('authToken', token);
      // Redirect to dashboard
      navigate('/dashboard');
    } else {
      // Handle error
      navigate('/login?error=auth_failed');
    }
  }, [searchParams, navigate]);

  return <div>Authenticating...</div>;
}

Make Authenticated Requests

Include the JWT in the Authorization header:

const token = localStorage.getItem('authToken');

fetch('http://localhost:8080/api/v1/reservations', {
  headers: {
    'Authorization': `Bearer ${token}`,
    'Content-Type': 'application/json',
  },
});

Production Configuration

Update Redirect URIs

For production deployment:

Update 42 Application

Go to your 42 OAuth application settings and add your production redirect URI:

https://api.yourdomain.com/oauth/callback

Update Environment Variables

REDIRECT_URI=https://api.yourdomain.com/oauth/callback
REDIRECT_TOKEN_URI=https://yourdomain.com/auth/callback

CORS Configuration

Ensure your backend allows requests from your frontend domain. See source code at internal/api/api.go for CORS middleware configuration.

JWT Token Structure

BookMe issues JWT tokens with the following claims:

{
  "sub": "user-uuid",
  "email": "[email protected]",
  "username": "username",
  "role": "student",
  "exp": 1234567890,
  "iat": 1234567890
}

Claim	Description
`sub`	User ID (UUID)
`email`	User email from 42 profile
`username`	42 username
`role`	User role: `student` or `staff`
`exp`	Token expiration timestamp
`iat`	Token issued at timestamp

JWT tokens are signed using the JWT_SECRET from your environment configuration. See internal/auth/auth.go:18 for implementation details.

User Roles

BookMe assigns roles based on 42 Intra user type:

Student

Can create reservations
Can view their own reservations
Can cancel their own reservations
Cannot see who booked other time slots

Staff

Can create reservations with Google Calendar sync
Can view all reservations and booking details
Can cancel any reservation
Can see who booked each time slot

Role determination logic is implemented in internal/oauth/provider42.go. The application checks the user’s 42 profile to determine if they are staff or a student.

Testing OAuth Flow

Start the Server

make run

Test Login Endpoint

Visit in your browser:

http://localhost:8080/oauth/login

You should be redirected to 42 Intra login.

Authorize Application

Verify Redirect

After authorization, you should be redirected to:

http://localhost:3000/auth/callback?token=eyJhbGc...

The JWT token will be in the URL query parameter.

Decode Token (Optional)

Use jwt.io to decode and inspect the token.

Troubleshooting

Redirect URI Mismatch

The redirect_uri MUST match the registered callback URL

Solution: Ensure REDIRECT_URI in .env exactly matches the redirect URI registered in your 42 OAuth application.

Invalid Client

invalid_client

Solution: Verify CLIENT_ID and SECRET are correct.

Access Denied

access_denied

Solution: User declined authorization. This is expected behavior if the user clicks “Cancel” on the 42 authorization page.

CORS Error

Access to fetch blocked by CORS policy

Solution: Check CORS middleware configuration in internal/api/api.go. Ensure your frontend origin is allowed.

Invalid Token

401 Unauthorized: invalid or expired token

Solution:

Check JWT_SECRET is the same value used to sign the token
Verify token hasn’t expired
Ensure token is included in Authorization: Bearer <token> header

Security Best Practices

Never expose your CLIENT_SECRET or JWT_SECRET in frontend code or version control.

Rotate Secrets Regularly: Change your JWT_SECRET periodically
Use HTTPS in Production: Always use secure connections for OAuth flows
Validate Redirect URIs: Only allow whitelisted redirect URIs
Set Token Expiration: JWT tokens should have reasonable expiration times
Secure Cookie Settings: Use HttpOnly and Secure flags for session cookies

Next Steps

After configuring OAuth:

Get Started

Setup & Configuration

Core Concepts

42 OAuth Setup

Overview

Create OAuth Application

Configure Environment Variables

Variable Descriptions

OAuth Flow

Frontend Integration

Handle Callback

Make Authenticated Requests

Production Configuration

Update Redirect URIs

CORS Configuration

JWT Token Structure

User Roles

Student

Staff

Testing OAuth Flow

Troubleshooting

Redirect URI Mismatch

Invalid Client

Access Denied

CORS Error

Invalid Token

Security Best Practices

Next Steps

Build docs developers (and LLMs) love

Get Started

Setup & Configuration

Core Concepts

​Overview

​Create OAuth Application

​Configure Environment Variables

​Variable Descriptions

​OAuth Flow

​Frontend Integration

​Login Button

​Handle Callback

​Make Authenticated Requests

​Production Configuration

​Update Redirect URIs

​CORS Configuration

​JWT Token Structure

​User Roles

​Student

​Staff

​Testing OAuth Flow

​Troubleshooting

​Redirect URI Mismatch

​Invalid Client

​Access Denied

​CORS Error

​Invalid Token

​Security Best Practices

​Next Steps

Build docs developers (and LLMs) love

Overview

Create OAuth Application

Configure Environment Variables

Variable Descriptions

OAuth Flow

Frontend Integration

Login Button

Handle Callback

Make Authenticated Requests

Production Configuration

Update Redirect URIs

CORS Configuration

JWT Token Structure

User Roles

Student

Staff

Testing OAuth Flow

Troubleshooting

Redirect URI Mismatch

Invalid Client

Access Denied

CORS Error

Invalid Token

Security Best Practices

Next Steps