auth

Google Redirect Callback

Step 1 of the Google Sign-In redirect flow.

Google posts a form with credential and g_csrf_token fields. We verify CSRF and the JWT, then 303-redirect to a same-origin GET that completes the login. The two-step approach is required because SameSite=Lax does not send the existing sim_session cookie on the cross-site POST from Google, but does send it on the subsequent same-origin GET — allowing anonymous-session promotion to work.

The verified credential is passed to step 2 via a short-lived SameSite=Lax; Secure; HttpOnly cookie so it never appears in URLs.

Emits auth_flow_event with stage=google_redirect.

post/api/auth/google-redirect

Request

  • Base URL: https://api.retirementlab.app (the document declares no server; this is the origin it was published from)
  • URL: https://api.retirementlab.app/api/auth/google-redirect
  • Auth: none declared

Response

Successful Response

unknown required

Changes

No recorded changes to this operation across all 1 revision of this API.