Is there a context in oAuth, reusable in the callback?

I am developing a home-grade web application (server-client, based on Nuxt and nuxt-auth-utils). I am using the opportunity to learn something about oAuth (and OpenID). One of the issues I face is that the exchange sequence does not seem to carry any context: a login is requested by the client, which queries the provider authentication page (say https://accounts.google.com/v3/signin/identifier?opparams... the login happens on the provider system the provider then does a callback to my service This callback structure is completely (as far as I know) in control of the provider, which means that I cannot provide any context to it. Specifically, I would like to know where the login request came from (which path on my side) To clarify this, imagine I have a /login page that does the authentication with the provider. Depending on where I called it from, I would issue a different redirect once the login is done: if it was from /profile then I would like to come back to /profile in the redirect if it was from /payment, then I would like to come back to /payment, etc. But since the callback has no information about where the initial (login) request came from, I am forced to have a hard-coded redirect, something like async onSuccess(event, { user, tokens }) { log.debug(`yeah, the login at Google worked!`) // do some useful stuff such as setting a cookie, registering the user, ... // and now I have to go somewhere, but I have to hard-code the destination return sendRedirect(event, '/') }, My question: is there a way, by oAuth standards, to pass to the oAuth provider information that this oAuth provider would send me back in the callback?

Apr 9, 2025 - 10:54

I am developing a home-grade web application (server-client, based on Nuxt and nuxt-auth-utils). I am using the opportunity to learn something about oAuth (and OpenID).

One of the issues I face is that the exchange sequence does not seem to carry any context:

a login is requested by the client, which queries the provider authentication page (say https://accounts.google.com/v3/signin/identifier?opparams...
the login happens on the provider system
the provider then does a callback to my service

This callback structure is completely (as far as I know) in control of the provider, which means that I cannot provide any context to it. Specifically, I would like to know where the login request came from (which path on my side)

To clarify this, imagine I have a /login page that does the authentication with the provider. Depending on where I called it from, I would issue a different redirect once the login is done:

if it was from /profile then I would like to come back to /profile in the redirect
if it was from /payment, then I would like to come back to /payment, etc.

But since the callback has no information about where the initial (login) request came from, I am forced to have a hard-coded redirect, something like

  async onSuccess(event, { user, tokens }) {
    log.debug(`yeah, the login at Google worked!`)
    // do some useful stuff such as setting a cookie, registering the user, ...
    // and now I have to go somewhere, but I have to hard-code the destination
    return sendRedirect(event, '/')
  },

My question: is there a way, by oAuth standards, to pass to the oAuth provider information that this oAuth provider would send me back in the callback?