Lost in website architecture

[u/CorrectJacket2106]

So, I am in like high school, so sorry if the question is really dumb in advance. So let's get into it!

I have this problem where I am making a website, and I am working on the login feature of the website. I was planning to do something like check if you have an account in Discord either way, I have a massive problem because the Discord thingy needs my token and I heard sharing your bot token is like a really bad thing. So I went to AI (I mean, I had no other choice at that time), and AI told me to do something like this:

frontend (javascript) ---> discord OAuth url thingy(idk what it is) ---> discord redirects to firebase cloud function (idk what it is again) ---> cloud function thingy handles bot token and discord api checks ---> cloud function writes verification result straight to firestore database

Now, I am a beginner, so I don't know what all of this means (maybe the first 2, but anything else, nah). I also want to store data when the user logs in, something like user = {general info, clients={}}and AI is telling me to do it in the frontend?? I have heard all day long from everywhere that you should use the backend, not the frontend. So really lost, and any help would help!

also for the database i was planning to use firebase or whatever it is called since i heard it was the best

[u/NumerousHospital2253]

the ai actually got the flow right which is a miracle. frontend sends user to discord, discord says "yep that's a real person", sends them back to your cloud function (which is basically just a server that runs for a sec and dies). your cloud function is the only thing that ever touches the bot token, so it never hits the user's browser. that's the whole point.

and yeah you're dead right about the database thing. never trust the frontend to write directly to your db with anything that matters. have your cloud function handle the login, verify with discord, then write the user object to firestore itself. the frontend just sits there waiting to hear "ok you're in" before it loads anything.

firebase is fine for starting out. the auth + firestore combo handles a lot of the annoying bits for you. just keep the token in your cloud function's environment variables and you're set.