# Read the developer Notes // still stuck

**URL:** <https://discuss.dev.twitch.com/t/read-the-developer-notes-still-stuck/22620>\
**Category:** API\
**Created:** [September 25, 2019, 2:29am UTC](https://discuss.dev.twitch.com/t/read-the-developer-notes-still-stuck/22620 "2019-09-25T02:29:51Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [September 25, 2019, 10:01am UTC](https://discuss.dev.twitch.com/t/read-the-developer-notes-still-stuck/22620/2 "2019-09-25T10:01:46Z")

</div>

Fairly sure that passport strategy is out of date for changes made to how Twitch Auth works, but I could be wrong, I don’t use it myself.

The docs cover how to perform authentication.

It doesn’t give an opinion on how to session manage or which language to use. (Passport Twitch provides an opinion)

Twitch Auth uses “standard” oAuth that you would find on many sites that authenticate via a third party

> [@Grommers00](#):
>
> //blurred out state as I’m unsure what this is

State normally acts as a nonce, a “single use” session token to prevent CSRF attacks.

> [@Grommers00](#):
>
> However, I’m stuck as to how to access the data from the users on my website? When I console.log  
> (req.session && req.session.passport && req.session.user)

As per this (after a google for “passportjs get user from session”)

> <https://stackoverflow.com/questions/14951789/passport-js-how-to-access-user-object-after-authentication>

The user is in `res.user`

> [@Grommers00](#):
>
> Am I approaching this the right way?

Sure it’s one approach

> [@Grommers00](#):
>
> I read over the developer notes, and none seem to take this approach. However, I’m not fully understanding the developer notes in terms of steps. (it recommends using get and the long URL

A common misread of the Documentation/lack of understanding of oAuth

> **[Getting OAuth Access Tokens](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/#oauth-authorization-code-flow)**
>
> Getting OAuth Access Tokens

Step 1) Perform a GET redirect (not a POST redirect) to Twitch  
Step 2) Check if a code is present in the question string after returning to your callback  
Step 3) Perform a server to server POST request to exchange the code for an access token.

Finally I checked the default installed for passport-twitch is for an unmaintained version. A more up to date version is here

> **[GitHub - Nigh7Sh4de/passport-twitch-new: Twitch (OAuth) authentication...](https://github.com/Nigh7Sh4de/passport-twitch-new)**
>
> Twitch (OAuth) authentication strategies for Passport. - GitHub - Nigh7Sh4de/passport-twitch-new: Twitch (OAuth) authentication strategies for Passport.

which itself hasn’t been updated since March last year

---

_[View the full topic](https://discuss.dev.twitch.com/t/read-the-developer-notes-still-stuck/22620)._