OAuth login

App Router

iron-session holds two things in an OAuth flow: the short-lived state on the way out, and the session on the way back.

How it works

A Server Action mints a random state, saves it in its own sealed cookie, and redirects to the provider with the same value in the URL.
The provider sends the visitor back to /callback with a code and that state. The route compares the two before trusting the code, and destroys the state cookie either way, so a link cannot be replayed.
Only then does it create the session. Skipping the state check is a login CSRF: someone hands you a callback URL carrying their code and your browser ends up in their account.
The state cookie uses a different password from the session, so neither can be presented as the other.
The provider here is part of the demo. A real one needs registered credentials, which a public example cannot hold, but the iron-session half of the flow is unchanged.