ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Security & identity · #oauth
An architecture note on Authorization Code flow with PKCE for public browser and mobile clients: the minimal design, trust boundaries, operational checks, failure modes, and when to redesign.
Learn how to enable one‑click sharing of web content to LinkedIn using the Share API, including authentication, request format, a curl example, and the limits you must watch for.
Architecture note on using ngrok's edge-level OAuth traffic policy to gate access to locally hosted services — requirements, minimal design, trust boundaries, operational checks, failure modes, and when to migrate.
PKCE binds an OAuth authorization code to the client that requested it, so an intercepted code cannot be exchanged for tokens. Here is the mechanism, a local test exchange, and the trade-offs.
Learn how to implement OAuth 2.0 with PKCE to secure public clients like SPAs and mobile apps, eliminating the need for insecure client secrets.
Step-by-step guide to adding PKCE to the OAuth 2.0 Authorization Code flow, enabling secure token exchange for clients that cannot store a secret.
Learn why OAuth 2.0 returns 'invalid_grant' when exchanging an authorization code, how to spot the exact cause with a diagnostic table, and step‑by‑step checks to fix redirect URI mismatches, code reuse, expiration, or clock skew.
Explore how integrating chat platforms with GitHub/GitLab OAuth reduces contributor friction by synchronizing identities and linking communities directly to repositories.
Learn how PKCE lets SPAs and mobile apps use the OAuth 2.0 authorization code flow without storing a client secret, and see a concrete curl‑based example.
linkedin
ngrok