OAuth2 style single sign on across the society's portals, with the authorization code exchange written by hand rather than pulled from a library.

01 Architecture

• Node.js and Express on MongoDB, with server rendered consent pages and a separate React admin console.
• Google is the only identity source, behind a hand rolled authorization code exchange rather than a drop in library.
• Each client registers against a whitelist of redirect URLs, so an open redirect cannot be introduced by a portal.
• Per client JWT issuance with crypto-js encrypted payloads, so one compromised portal cannot mint credentials for the others.
• The full exchange is hand written: build the consent URL, take the code back, exchange it, fetch the profile.

02 What is in it

• One identity across every society portal, from the merch store to the exam system, for a 5,000+ community.
• Consent screen shows exactly which scopes a client is asking for.
• Admin console for registering and revoking clients without a deploy.