I'm building a desktop application with electron/react, which allows the users to sign up/login, but only if they have a specific email domain (email@example.com). I have a working API written in golang that can successfully serve GET requests. As for authentication, I've tried mapping out my authentication flow, but I'm at a point where I just don't know what to do next. Here's my poorly constructed method:
-User fills out form with information
-If email domain is valid, A token is generated on the client (I'm not sure if this is really a correct way to do it. I think it might be better to have the serve generate the token, but then wouldn't I have to implement some sort of table of users currently signing up?)
-Token is emailed to the address they signed up with via smtp service
-App navigates to validation screen
-User enters token and it is checked against the generated token
-If token is correct, we send credentials to to backend to generate a user field.
Here is where i kinda just stumped myself. How do I tell the API that it is okay to enter in this user? I could send it a JWT token but from what I understand, you do not wanna do that on the front end. However, I feel like I could solve a lot of problems if my front end could simply add verification to a get request.
If anyone has any articles I could read to steer me in the right direction, I would appreciate it! Thank you!