title: NodeJS send a token in the url when redirecting user after login
body: <p>I'm building an application with nextJs for frontend, and nodejs for backend with using passportjs and facebook strategy for authentication.
  And I want to send a token for the client after the authentication. After some research I've found the solution below:</p>
  <pre><code>router.get(
    &quot;/auth/facebook/callback&quot;,
    passport.authenticate(&quot;facebook&quot;, {
      session: false,
    }),
    (req, res) =&gt; {
      // generate token ...
      res.redirect(`localhost:3000/home?%{token}`)
    }
  )
  </code></pre>
  <p>And then, in the client, I would get the token in the query params and save it on localstorage to use it in the requests.</p>
  <p>But my question is: does this solution leaves the token too vulnerable? is there a better way to do it?</p>
  <p>If anyone could help me. I'm kinda lost in what's the best way to handle this situation.</p>