OAuth callback tests often stop at “the user returned and the token was issued.” That verifies the happy path, but it leaves the most important question unanswered: can the callback prove that this response belongs to the browser session that started the login?

The useful mental model is a small state ledger. Each authorization attempt gets a short-lived record. The callback consumes that record only when the provider, redirect URI, browser session, state , and PKCE proof all agree. This makes tests more precise and makes production failures easier to investigate.

The callback is a security boundary

An OAuth callback receives data from a browser redirect, so it should be treated as an untrusted boundary.…