Redirecting back to wherever sign in was initiated from

[felixizraitel]

Is this basically the recommended way to do this and then read the cookie on the other end?

path: /api/auth/login/google

import { google } from "@/lib/auth/providers";
import { generateCodeVerifier, generateState } from "arctic";
import { cookies } from "next/headers";

export async function GET(req: Request): Promise<Response> {
  const state = generateState();
  const codeVerifier = generateCodeVerifier();
  const reqURL = new URL(req.url);
  const referer = req.headers.get("referer");
  const callback = referer ? new URL(referer).pathname : "/";
  const url = await google.createAuthorizationURL(state, codeVerifier, {
    scopes: [
      "https://www.googleapis.com/auth/userinfo.email",
      "https://www.googleapis.com/auth/userinfo.profile",
      "openid",
    ],
  });
  cookies().set("google_oauth_state", state, {
    path: "/",
    secure: process.env.NODE_ENV === "production",
    httpOnly: true,
    maxAge: 60 * 10,
    sameSite: "lax",
  });
  cookies().set("google_oauth_code_verifier", codeVerifier, {
    path: "/",
    secure: process.env.NODE_ENV === "production",
    httpOnly: true,
    maxAge: 60 * 10,
    sameSite: "lax",
  });
  cookies().set("google_oauth_redirect", callback, {
    path: "/",
    secure: process.env.NODE_ENV === "production",
    httpOnly: true,
    maxAge: 60 * 10,
    sameSite: "lax",
  });

  return Response.redirect(url);
}

[pilcrowonpaper]

You can also just pass the callback URL in the search params, but if you do, you have to be careful about open redirects

https://thecopenhagenbook.com/open-redirect

but referer works as well