OAuth 2.0 and JWT Explained: How "Login with Google" Actually Works

Common Mistakes Worth Remembering

• Storing a JWT in localStorage — directly readable by any injected script, making it a prime XSS target. An httpOnly cookie is the safer default for anything resembling a session credential.
• Treating a valid signature as proof of authorization to do anything. A JWT proves identity/claims and that the payload wasn't tampered with — it proves nothing about whether the specific action being attempted is actually permitted; the API still has to check the claims (and scopes) against what that action requires.
• Trusting the alg field a token claims, rather than pinning the expected algorithm in the verifier — the root cause of the RS256-to-HS256 downgrade attack described earlier.
• Skipping aud (audience) validation, letting a token legitimately issued for one service be accepted by a different one that merely trusts the same issuer.
• Assuming a JWT can be revoked like a session — it can't, on its own; real-time revocation needs either a server-side check on every request or short expiries paired with a revocable refresh token.
• Confusing an access token with an ID token and sending the wrong one to the wrong consumer — an access token proves permission to an API; an ID token proves identity to your own application.
• Requesting broader OAuth scopes than the application actually needs, widening the impact of any future token leak for no functional benefit.
• Not validating redirect_uri strictly against a pre-registered allowlist, opening the door to authorization-code theft via a lookalike redirect target.
• Skipping PKCE on a public client (a mobile app or SPA) under the assumption that "we don't have a client_secret to worry about" — PKCE exists specifically because that client type can't hold one.

React Fundamentals covers the client-side half of building the login UI these flows sit behind — see React Fundamentals for the component and effect patterns involved in wiring up an actual auth flow. Practice reasoning about tokens, scopes, and access-control scenarios in the code lab.