Authority Gates

Two gate patterns, built from scratch

The admin route was sitting open on a deployed web app. Whoever built it knew. Adding real auth was on the list. Six weeks later, the next sprint had not touched it. That is not negligence — it is gravity. Auth is invisible when nothing has gone wrong. Every deployment adds momentum toward later. Later compounds into a gap that a crawler will find before you do.

This book covers two distinct gate patterns. The first: OAuth authorization for an installed application that calls a Google API on your behalf — Calendar, Sheets, Gmail, Drive. The consent screen appears once, a token file is written to disk, and subsequent runs present the token automatically. The second: a session gate for a web app you own, where the auth boundary is yours to build and yours to maintain.

Both patterns are built complete. The Google Cloud Console setup chapter walks every step from project creation to first-run browser flow. The session gate chapters go further: bcrypt verification with constant-time comparison, rate limiting that locks an IP after five failed attempts, session fixation prevention, HTTPS enforcement, and the shared-host session-storage trick that stops a hosting provider’s aggressive garbage collector from logging users out mid-session.

OAuth to pre-deploy audit

• Google Cloud Console setup — Creating a project, enabling the API, generating OAuth 2.0 credentials, downloading the client secret, and completing the first-run browser flow. The exact steps, with the exact screens that trip people up.
• The token lifecycle — What lives in the token file, how the refresh flow works, where it breaks when the token expires, and how to detect expiry before it causes a failed run mid-session.
• The Python OAuth client — The installed-app flow implemented as a reusable Python module. How to authorize against multiple Google scopes in one consent request, and how to call the API after the token is in place.
• The PHP session gate — Bcrypt verification with constant-time comparison, a rate limiter that locks an IP after five failed attempts, session fixation prevention on login, and HTTPS enforcement at the server level.
• Shared-host session tricks — The session storage configuration that prevents a shared host’s garbage collector from expiring active sessions, and how to verify the fix is working without logging real users out.
• The pre-deploy audit — The checklist Claude runs before any endpoint goes live: auth on every protected route, constant-time comparison in place, rate limiter active, session fixation wired, HTTPS enforced. A signed checklist or no deploy.

A preview

“I’ll add auth later” is the most expensive sentence in web development. It is not a plan; it is a deferral that compounds. The gap does not stay the size it was when you left it. Traffic grows, the codebase grows, the surface area of what is exposed grows. The sentence that felt like a reasonable trade when you said it in week one is a much more expensive fix in week eight, and a much more expensive incident in week twelve.

Developers who ship before auth is done

This book is for developers who have a script that needs to call a Google API, and for developers who have built a web app without proper auth and need to retrofit it without breaking what already works. The two gate patterns are independent — take the one that fits your situation, or build both. Every technique is drawn from real deployments on real infrastructure, including the shared-host constraints that most auth tutorials skip entirely.

A longer excerpt is available to newsletter subscribers.

Buy Ebook on Amazon