all my real oauth knowledge came from this https://labs.detectify.com/2022/07/06/account-hijacking-usin...