Sign in with Google: how OAuth lets an app in without your password
OAuth code exchange: how the app collects its tokens from Google
After Sign in with Google, an app holds an authorization code. How does it trade that code for tokens, and why can a stranger who catches the code not do the same?
-
1
Rono's app holds your code now. Yet a code is not a way in: show it to Google Calendar, and the calendar turns it away. The code has to be traded at Google first.
-
2
Trading it cannot be that simple, though. If anyone holding the code could trade it, a code seen on its way would be as good as a way in.
The rest of this episode is for subscribers
Subscribe to read every premium episode. You can cancel when you want.
Paid yearly: $99 instead of $119.88