All projects
security
Sign in with a third party, done safely
Implement the OAuth authorization code flow with PKCE, and understand every parameter.
Why it matters
Nearly every app has social login and nearly every developer copied it from a tutorial. Being the person who can explain what state and PKCE are for is a real differentiator.
What you build
- The authorization code flow with PKCE
- State validated to stop CSRF
- Tokens stored somewhere defensible
- A written explanation of each parameter
If you want more
- Add refresh token rotation
- Support a second provider
Build it
Material for the whole build
Shows you can implement security-sensitive flows from the specification rather than from copy-paste.
Get a plan built around projects like this