What the user sees
https://secrets.example.com/dashboard
Demo simulation — do not enter real credentials
Redirecting to login...
What's happening (HTTP)
Browser
OTS
Google
REQUEST Browser → OTS
GET https://secrets.example.com/dashboard
Cookie: (none)
💡 No session cookie present
INTERNAL OTS → OTS
Generate OAuth2 parameters
💡 Generate code_verifier (random 43-char string), compute code_challenge = BASE64URL(SHA256(code_verifier)), generate random state and nonce. Store all three server-side keyed by session.
RESPONSE OTS → Browser
302 Found
Location: https://accounts.google.com/o/oauth2/v2/auth?
client_id=123456789.apps.googleusercontent.com
&redirect_uri=https://secrets.example.com/auth/callback
&response_type=code
&scope=openid email profile
&state=xYz9Kp2mN7qR4sT1
&nonce=aB3cD5eF7gH9iJ1k
&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
&code_challenge_method=S256
&access_type=offline
&prompt=consent
💡 Redirect to Google with PKCE challenge, state, and nonce
Legend
Browser request
Server response
Server-to-server
Internal process