Added Google sign-in for posting and deleting
What changed
- NewThe 'sign in' button
- NewWhere Google sends you back
- ChangedYour browser's signed-in status
- ChangedDeleting a note
Worth understanding
How 'Sign in with Google' actually works
OpenID Connect (OIDC) authorization code flow
Instead of the app storing passwords, it sends visitors to Google to prove who they are, then Google hands back a signed statement of identity that the app trusts.
Worth a look
Any signed-in user can delete anyone else's note
Signing in now protects the delete button from strangers, but it doesn't check whether the note is actually yours. Any team member who's signed in can delete anyone's note, not just their own.