Lion Cipher Lab
What really happens when you 'Sign in with Google'
- Identity & Access Management
- Beginner
- ~30 min
- Free · no account required
Why it matters
The 'Sign in with Google' button is one of the most-clicked controls on the internet, and one of the least understood. Two opposite fears follow people around it: that logging in this way hands a random website their Google password, and that it lets that website read all their email. Both are wrong, and the truth is a genuine security upgrade -- but only if you can see why. This lab replaces the guessing with observation: you open the same DevTools panel professionals use and watch a real sign-in happen on your own account. You will see your browser get redirected to the provider, see the…
What you'll learn
- OAuth 2.0 roles
- authorization-code flow
- OpenID Connect vs OAuth
- authentication vs authorization
- scopes and consent
- reading redirects in DevTools
- why single sign-on is safer
- delegated access
Steps in this lab
- The button is not magic -- it is a protocol
- Meet the cast: the three roles in every sign-in
- Open DevTools and get ready to watch
- Watch the hand-off: your browser leaves for the provider
- Read the scopes: consent is you granting exactly this much
- Watch the code come back -- and why your browser never sees the token
- OAuth vs OIDC: the ID token, and what single sign-on buys you
- What you can now see that you could not before