Overview

Rolling your own OAuth2 flow is a minefield. We document every footgun we found during an internal security audit.