OAuth Redirect Maze: Debug Login Across Environments Without Guesswork

Login works locally, fails in staging, and breaks differently in production. Participants debug an OAuth flow with mismatched redirect URLs, wrong cookie domains, missing scopes, expired state, clock skew, and confusing provider error messages.

The lab teaches a disciplined way to inspect auth flows without leaking secrets: capture safe request facts, compare environment config, verify callback handling, and document exactly which party rejected the login and why.