The engineering questions you get asked, and the bugs you actually hit. Drawn, one mechanism at a time, in the order the videos ship.
A bearer token can't be recalled, so the only way to bound the damage is to bound the time. Everything else — the split, the 401, the rotation — falls out of that one sentence.
Three parties, one redirect, and a code traded for a token. The whole protocol is visible in your address bar, and nobody ever tells you to look.
Three attributes decide whether your cookie is sent at all. Here's what each one does, and why yours is missing.
One is a pointer, the other is a copy. Almost every argument about them comes from missing that one line.
Not the definition. The four things you actually send, what each one is for, and how to find the one that's wrong.
