Backend Study Lab · Games
← All games

OAuth Code Flow Debugger

Trace Authorization Code flow failures across state, PKCE, redirect URI, token exchange, and session boundaries.

Concept
OAuth Authorization Code flow
Difficulty
Advanced
Play time
8-11 minutes
Path
Foundations

Interactive scenario

Playable game area: Make the next backend decision

Use the controls below. Feedback appears immediately and final scores stay in this browser.

Concept notes

Why this decision matters

OAuth Code Flow Debugger is focused practice for OAuth Authorization Code flow. It explains why each answer is safe, risky, or production-ready.

Debug the complete flow as a chain of bindings rather than a single login callback.

Learning objectives

  • Bind callbacks with state.
  • Preserve the PKCE verifier.
  • Keep long-lived credentials out of browser JavaScript.

How to play

  1. Follow each redirect and token hop.
  2. Choose the control that restores the trust boundary.
  3. Review why valid-looking values can still belong to the wrong flow.

Scoring

  • Correct flow repairs add 250 points.
  • Misses enter local review.
  • A perfect run scores 1,000.

Backend concept notes

Authorization Code flow separates browser redirects from server token exchange.

State, PKCE, and exact redirect matching address different substitution threats.

Common mistakes

  • Accepting mismatched state.
  • Generating a new PKCE verifier after redirect.
  • Exposing refresh tokens to browser storage.

Review misses from this game

Related Backend Study Lab tools

Use tools from the main site when you want to inspect real inputs.

Keep practicing nearby backend concepts while the mental model is fresh.

Auth Intermediate

Auth Token Inspector

Inspect authentication scenarios and choose safe backend decisions for tokens, scopes, sessions, CSRF, and object-level authorization.

Time
6-9 minutes
Concept
Authentication, authorization, sessions, and token safety
  • Foundations
  • Auth
  • JWT
  • sessions
Play Auth Token Inspector
APIs Intermediate

CORS Preflight Pilot

Guide browser API requests through CORS decisions covering origins, preflight, credentials, exposed headers, and cache safety.

Time
6-9 minutes
Concept
CORS, browser security boundaries, and preflight response design
  • Foundations
  • CORS
  • HTTP
  • browser security
Play CORS Preflight Pilot

FAQ

Short answers for how this game fits backend interview and study practice.

Is state replaced by PKCE?

No. They protect different bindings and are commonly used together.

Why must redirect URIs match exactly?

Exact matching prevents authorization codes from being redirected to attacker-controlled destinations.

Leaderboard

Top 10 scores for the current ruleset. No account required.

Loading leaderboard...

    Finish the game to load your latest local score.