OAuth callback safety proof

A small synthetic work sample for integrating Google OAuth into a web app. It focuses on the failure and abuse cases that are easy to miss in a happy-path demo:

• authorization requests include a session-bound state value;
• OAuth uses PKCE with the S256 challenge method;
• callbacks expire and are consumed exactly once;
• a wrong state never reaches token exchange;
• the application session cookie is HttpOnly, Secure, and SameSite=Lax.

Run

npm test

The proof uses Node's standard library and built-in test runner. It does not contain credentials, contact Google, or require a real account.

Scope and limitations

This repository is a synthetic technical sample, not a claim of previous commercial delivery and not a drop-in production authentication system. A real integration still requires the client's framework, session store, redirect URI, consent-screen configuration, account-linking rules, and staging error logs. Pending OAuth state must use durable server-side storage in a multi-node deployment.