Why OAuth Exists
The scenario everyone recognizes Your application wants to access a user's data on another service — their Google Calendar, GitHub repositories, or company files in SharePoint. The naive approach: ask
Jun 30, 20264 min read5
Command Palette
Search for a command to run...
Series
OAuth Explained
The OAuth Mental Model
Four roles (memorize these) OAuth names four actors. Everything else hangs off them. Role Plain English Example Resource owner User who can grant access Alice Client App requesting access Yo
Jun 30, 20264 min read18Authorization Code + PKCE
The one flow to learn first If you implement only one OAuth flow, make it Authorization Code with PKCE (Proof Key for Code Exchange). It works for: Server-side web apps (Spring Boot, Django, Rails)
Jul 2, 20264 min read58Identity Providers Are Not the Complete Solution
The myth "We'll buy Okta / Auth0 / deploy Keycloak — then auth is done." Identity providers (IdPs) and authorization servers solve a specific, hard problem: issuing tokens after authenticating a use
Jul 4, 20265 min read10OAuth Mistakes in Production
This post is a checklist disguised as war stories Every item below appears in real audits. OAuth did not fail — configuration and application code did. 1. Redirect URI laxity Mistake: Register https:
Jul 4, 20264 min read44OAuth with Spring Security
GitHub: github.com/mnafshin/oauth What we are building A minimal server-rendered Spring Boot web app that: Redirects unauthenticated users to Keycloak Completes Authorization Code + PKCE (Spring ha
Jul 5, 20267 min read3