The Scenario
Your users are tired of remembering passwords. Management wants to add a "Login with Google" button. You cannot use a pre-built library like Passport.js; you must orchestrate the raw OAuth 2.0 flow yourself to prove you understand it.
The Brief
Architect the OAuth 2.0 Authorization Code flow. Document the exact HTTP requests that happen between the User, your Backend, and the Google Authorization Server. Pay special attention to the `state` parameter.
Deliverables
- A sequence diagram (or detailed step-by-step list) of the OAuth 2.0 flow
- An explanation of the `state` parameter and how it prevents CSRF attacks during the OAuth redirect
- A description of how you link the incoming Google Identity to an existing user in your database
Submission Guidance
Do not confuse Authentication with Authorization. We are using OAuth 2.0 (specifically OpenID Connect) to authenticate the user. Explain how the short-lived Authorization Code is exchanged for tokens.
Submit Your Work
Your submission is graded against the rubric on the right. If you pass, you get a public Badge URL you can share on LinkedIn. There is no draft save, so work offline first and paste your finished response here.