I am using react-twitter-auth as part of my OAuth 1.0a user authentication flow on my site. My goal is to authenticate a user and then access their username. So far I have a bunch of code I borrowed from a website. There is client side code and backend code.

The client starts the authentication flow, sending a request to http://localhost:4000/api/v1/auth/twitter/reverse. There, I see from a console.log statement that I have the oauth_token value that I will need later for step 3 of the so-called "3 legged auth" authentication flow that I am going through.

Here is the server route I am hitting:

router.route("/auth/twitter/reverse").post(function (req, res) {
  console.log(72);
  request.post(
    {
      url: "https://api.twitter.com/oauth/request_token",
      oauth: {
        oauth_callback: "http://localhost:3000/",
        consumer_key: twitterConfig.consumerKey,
        consumer_secret: twitterConfig.consumerSecret,
      },
    },
    function (err, r, body) {
      if (err) {
        console.log(err, 83);
        return res.send(500, { message: e.message });
      }

      var jsonStr =
        '{ "' + body.replace(/&/g, '", "').replace(/=/g, '": "') + '"}';
      console.log(jsonStr, 88);
      res.send(JSON.parse(jsonStr));
    }
  );
});

I get values such as:

{ "oauth_token": "HnQ1SgAAAAAAAABco", "oauth_token_secret": "y1qeyxZeiCEWqkKz9y", "oauth_callback_confirmed": "true"} 88

Some characters have been deleted in case that isn't data I should be exposing. Anyway:

I need that "oauth_token" value to make it to my client. Why? Because I'm getting a pin in the 3 legged auth part, and so I need both values to arrive on my server at the same time.

If i wasn't using the react-twitter-auth library, I would have no problem here, because I would just be sending a http request via fetch, and so I would have a .then() block to show me what the value of res.send(JSON.parse(jsonStr)); is on the frontend. But I don't have that, nothing is there to listen for the res.send() part. How can I listen for it?

Thanks

edit: I am critical of this library because it doesn't account for what happens with the PIN based strategy for 3 legged auth.