Decoding OAuth Flow

Context

A comprehensive frontend simulation of modern authentication workflows using the OAuth 2.0 protocol. This project demonstrates how secure access is granted through token exchange, redirection, and user authorization — without relying on third-party providers. It introduces role-based access control (RBAC) and showcases how permission logic is structured and enforced within an application. Designed for clarity and adaptability, this showcase serves as a blueprint for building secure and scalable login systems that prioritize user data protection and system integrity.

Goals

• Secure Google OAuth 2.0 authentication
• Client/secret stored as environment variables
• Separate development and production settings
• Clean and minimalist login-success screen
• Fully deployed and functional production endpoint
• Redirect URIs fully authorized and tested
• Uses SECURE_SSL_REDIRECT, ALLOWED_HOSTS, and proper CSRF protection

Constraints

• OAuth 401 / 400 errors due to: deleted or mismatched ID, incorrect or missing redirect URIs, quoted dictionary in .env, environment variables desynced between .env and Railway
• Railway auto-injecting quotes in variables
• Error tracebacks not showing full context in production
• Social-auth's vague AuthCanceled traceback

Approach

• Carefully matched GOOGLE_OAUTH2_CLIENT_ID and secret between GCP and .env
• Corrected all Redirect URIs in Google Cloud Console
• Used json.loads() with a properly formatted JSON string (double quotes only)
• Manually verified Railway environment variables via Raw Editor
• Triggered fresh deploy after edits instead of relying on implicit updates
• Kept Tailwind out for clarity and control (classic HTML/CSS templating)
• Logged and inspected all response paths via Railway logs for final debugging

Results

• Secure auth flow using OAuth 2.0 and hardened deployment setup.

Stack