himelranaswe/oauth2-playground repository overview

⁠HimoSoft OAuth2 Playground

Public image: himelranaswe/oauth2-playground

Test and debug OAuth 2.0 / OpenID Connect providers with a modern Next.js app. Supports Authorization Code (with PKCE), token exchange, optional refresh, and userinfo fetching.

Docker Hub: https://hub.docker.com/r/himelranaswe/oauth2-playground⁠

Source code: https://github.com/Swe-HimelRana/oauth2-playground⁠

⁠Quick start

docker pull himelranaswe/oauth2-playground:latest
docker run --rm -p 3000:3000 himelranaswe/oauth2-playground:latest
# Open http://localhost:3000

⁠For apple silicon or ARM Processor

docker pull himelranaswe/oauth2-playground:arm
docker run --rm -p 3000:3000 himelranaswe/oauth2-playground:arm
# Open http://localhost:3000

⁠Highlights

• Authorization Code + PKCE (S256)
• Dynamic redirect URI (prefilled from host)
• Token exchange and secure storage in httpOnly cookies
• Optional refresh flow (if provider issues refresh_token)
• UserInfo viewer (Authorization header; fallback to query param)
• Re-authorize shortcut for providers without refresh tokens
• One-click Clear Saved (wipes localStorage + cookies)

⁠How to use

1. Open the app and fill:

• Authorization Endpoint
• Token Endpoint
• Optional UserInfo Endpoint
• Client ID and optional Client Secret
• Redirect URI (auto-filled)
• Scope (e.g., openid profile email)
• Response Type = code (recommended)
• Client Auth Method = basic or body
• Extra params per line, e.g. prompt=consent, access_type=offline

1. Start OAuth → consent → app exchanges code → see tokens in /oauth/result.

2. Use Get UserInfo, Refresh Token (if available), Re-authorize (if no refresh token).

⁠Provider notes

• Google: add access_type=offline and prompt=consent for refresh tokens
• Microsoft Entra ID: include offline_access in scope
• Auth0/Okta: include offline_access scope

⁠Configuration

No environment variables are required. The app is stateless; tokens/config are stored in secure cookies and form values (convenience only) in localStorage.

⁠Security

• Use HTTPS in production
• Register the exact redirect URI with your provider
• Prefer Authorization Code + PKCE for public clients

⁠Tags

• latest: latest published build
• <version>: syncs with app package.json (e.g., 0.1.0)

⁠License / Contact

• © HimoSoft. All rights reserved
• Issues/bugs: [email protected]⁠