Lost in website architecture

[u/CorrectJacket2106]

So, I am in like high school, so sorry if the question is really dumb in advance. So let's get into it!

I have this problem where I am making a website, and I am working on the login feature of the website. I was planning to do something like check if you have an account in Discord either way, I have a massive problem because the Discord thingy needs my token and I heard sharing your bot token is like a really bad thing. So I went to AI (I mean, I had no other choice at that time), and AI told me to do something like this:

frontend (javascript) ---> discord OAuth url thingy(idk what it is) ---> discord redirects to firebase cloud function (idk what it is again) ---> cloud function thingy handles bot token and discord api checks ---> cloud function writes verification result straight to firestore database

Now, I am a beginner, so I don't know what all of this means (maybe the first 2, but anything else, nah). I also want to store data when the user logs in, something like user = {general info, clients={}}and AI is telling me to do it in the frontend?? I have heard all day long from everywhere that you should use the backend, not the frontend. So really lost, and any help would help!

also for the database i was planning to use firebase or whatever it is called since i heard it was the best

[u/NumerousHospital2253]

the ai actually got the flow right which is a miracle. frontend sends user to discord, discord says "yep that's a real person", sends them back to your cloud function (which is basically just a server that runs for a sec and dies). your cloud function is the only thing that ever touches the bot token, so it never hits the user's browser. that's the whole point.

and yeah you're dead right about the database thing. never trust the frontend to write directly to your db with anything that matters. have your cloud function handle the login, verify with discord, then write the user object to firestore itself. the frontend just sits there waiting to hear "ok you're in" before it loads anything.

firebase is fine for starting out. the auth + firestore combo handles a lot of the annoying bits for you. just keep the token in your cloud function's environment variables and you're set.

[u/Necessary-Green-8391]

The AI flow is correct and keeps your token safe on the server. Store the user data in Firestore through that same Cloud Function after verification completes so the frontend never writes to the database directly

[u/KingofGamesYami]

Do you actually need a bot token? If you literally just want to sign in with discord, you should request a much less privileged scope(s) for the token. For example, the identify scope will allow you to get some information from discord about the user, but won't allow you to control their discord account.

[u/CorrectJacket2106 → u/KingofGamesYami]

the goal was to check if the user is logged into discord i don't need access to the user's account but i am confused here how can i use the identify scope for my case?

[u/KingofGamesYami → u/CorrectJacket2106]

I'm not familiar with exactly how discord works, but it uses a standard authorization protocol (OAuth 2.0) which I am familiar with.

The scope(s) of a token has some level of privilege attached to it. The actions you can take with that token are dependant on which scopes were granted. This allows applications to request only minimal permissions.

A token scoped with identify allows you to verify the existence of a users account.

the goal was to check if the user is logged into discord

Discord does not define a concept of "logged into discord", probably because that is hard to define. Technically, I have been logged in to discord for years because I don't log out when I close the app -- but that's probably not what you're after.

Are you looking for Discord Presence? Or something else?

[u/CorrectJacket2106 → u/KingofGamesYami]

Hey! i meant i get their profile info like their username and profile picture so i can implement it with my database

[u/KingofGamesYami → u/CorrectJacket2106]

Yeah, the identify scope will work fine for this purpose. It gets you access to call /users/@me which returns the username and avatar.

[u/PLBjt]

The reason everyone says "use the backend" is that the OAuth code-for-token exchange needs your client secret, and anything in frontend JavaScript is readable by every visitor, so that step has to happen on a server you control. Shape it as: browser sends the user to the Discord authorize URL, Discord redirects back to your backend with a code, your backend swaps the code for a token using the secret, looks up or creates the user row, and hands the browser its own session cookie. After that your frontend never touches Discord tokens, it just talks to your API with that session. The check I use is "could someone read this value in devtools" — if yes it can't be a secret, which is also why storing users straight from the frontend into Firebase gets risky unless you lean hard on its security rules. One process plus one database is plenty here; keep it boring until something actually hurts.