✓
Verify Google tokens
Never treat a browser callback alone as proof that a user is authenticated.
Security
Keep authentication on the server.
The current site is a front-end prototype. A production Minivo OAuth service should verify Google ID tokens on the backend, hash passwords, use secure sessions, validate redirect URIs, and use OAuth protections such as PKCE and state.
#
Hash passwords
Passwords belong on a backend and should be stored only as strong password hashes.
↗
Validate redirects
Only registered application callback URLs should be allowed.