From a Broken Side Project OAuth Bug to Enterprise SSO Token Exchange

Short summary

An engineering post tracing a Google OAuth session-bleeding bug in a side project to its application in enterprise SSO design. The bug allowed citizens to access an admin dashboard because the backend verified session validity but not application context. The fix involved application-specific cookies, pre-authentication destination validation, and role hierarchies — lessons later applied to designing a secure cross-application handoff token flow at work.

• •OAuth bug allowed cross-application session bleeding between citizen and admin portals
• •Fix: app-specific cookies, destination validation before auth completes, role hierarchy enforcement
• •Same principles scaled to enterprise SSO handoff token flow design

Generated with AI, which can make mistakes.