Game Dev - User Registration & DB management (advice needed)

[renato (Renato Atilio)]

When you use Discourse as the identity provider as Richard suggested, Discourse will handle email validation for you.

When the user goes through the SSO flow on Discourse and then back to your website, you can use the response that Discourse adds as an embedded query string to the sso param, containing email, username, name, groups, etc (but not password, that would not be a good idea), which you can extract and properly validate using the provided sig.

@techAPJ

Get response from Discourse:

If the above steps are done correctly Discourse will redirect the logged-in user to the provided RETURN_URL. You will get query string parameters with sig and sso along with some user info. Now follow below steps:

• Compute the HMAC-SHA256 of sso using sso provider secret as your key.
• Convert sig from it’s hex string representation back into bytes.
• Make sure the above two values are equal.
• Base64 decode sso; you’ll get the passed embedded query string. This will have a key called nonce whose value should match the nonce passed originally. Make sure that this is the case, and be sure to delete the nonce from your system.
• You’ll find this query string will also contain a bunch of user information. Use as you see fit.