Repair OAuth PKCE Flow Mixups

The problem

Race conditions and session-scoped state often cause OAuth flows to collide when users open multiple tabs or retry logins. This leads to code_verifier mismatches, provider identity loss, and corrupted authorization transactions that are notoriously difficult to debug in production.

What it does

• Identifies where concurrent OAuth transactions overwrite shared session state or PKCE verifiers.
• Enforces strict ownership between callbacks, cached state, and the specific transaction generation.
• Fixes redirect URI mismatches between the authorization and token exchange phases.
• Implements deterministic local IdP fakes to reproduce concurrency bugs without live secrets.
• Redacts sensitive observability data while improving metrics for terminal failure reasons.

Frameworks & tools

Works with any repository using OAuth 2.0, OIDC, and PKCE. Compatible with Bash, Read, and Edit toolsets for codebase patching.

Why this beats prompting it yourself

General LLMs often suggest insecure workarounds like increasing timeouts or loosening validation. This skill follows a mandatory safety discipline that preserves strict PKCE and OIDC specs while fixing the underlying state synchronization logic.

Use cases

• Fixing "invalid_grant" errors caused by multiple browser tabs overwriting session cookies.
• Correcting flows where a callback for Provider A inadvertently attempts to resume a flow for Provider B.
• Ensuring one-time state consumption to prevent replay or reuse of authorization codes.
• Patching mismatched redirect_uri parameters across complex multi-tenant environments.

Known limitations

Requires access to repository files to perform analysis. Cannot interact with production services or read live secrets.