Module loopback 

The door a browser comes back to after a sign-in on a provider’s page, as native apps should have it (OAuth 2.0 for native apps, RFC 8252 §7.3): a port of this device’s loopback address, chosen by the system, open for one sign-in. Google’s sign-in (google.rs) and Microsoft’s (microsoft.rs) share it; each provider says what an answer means (Verdict) and which page the browser then shows, in your language.

What counts is the request line, GET /?state=…&code=… HTTP/1.1; the request is read whole, its headers too, at most LINE_BYTES of it, within LINE_TIME of the connection, Cancel heard meanwhile: a connection that says nothing, or says too much, is dropped, and cannot hold the door past Cancel or the code’s minute (the review of 15 October 2026, L1). Read whole, so that closing it after the page is an orderly end: unread headers would make it a reset, and the browser’s tab might say “connection reset” (the re-check, L1-bis). A request without a query (a favicon) gets a 404 and the wait goes on. The state is compared in constant time. An answer that waits in the system’s queue is read even once the time is up (a phone freezes Sioul while the browser is in front, and its clock then jumps), for LATE_CONNECTIONS connections at most.

Also here, what both providers’ requests need: PKCE’s verifier and challenge (RFC 7636), a random state, and the form encoding of a query.

Structs

Answer 🔒

One answer at the door: its query’s values, and whether its state is the sign-in’s (compared in constant time; false when it has none).

Ends 🔒

How a wait ends without an answer: Cancel pressed, or the time up.

Enums

Verdict 🔒

What a provider makes of an answer: the page the browser shows (a message id), and either the wait’s outcome or nothing (the wait goes on).

Constants

LATE_CONNECTIONS 🔒

Connections still read once the time is up, as long as they wait in the queue (the browser’s answer among them, after a phone’s freeze); past them the wait ends, however many more keep coming.

LINE_BYTES 🔒

The most a request may hold, its line and headers: a browser’s answer, its code and state included, and its headers (cookies for 127.0.0.1 among them) are a few kilobytes at most.

LINE_TIME 🔒

The most time a connection has to say its request: a browser says it at once.

Functions

challenge 🔒

PKCE’s challenge for a verifier: SHA-256, as URL-safe base64 without padding (S256).

decode 🔒

A query’s value as it was before being encoded (+ a space).

encode 🔒

Percent-encodes a value: everything but RFC 3986’s unreserved characters.

open 🔒

Opens the door: 127.0.0.1 on a port the system chooses; else, when ipv6 allows it, [::1] (Google takes either; Microsoft takes no IPv6 loopback). The listener, and the redirect address the provider is given (no path: http://127.0.0.1:<port>).

query 🔒

key=value&…, each value percent-encoded.

random 🔒

Random bytes (version 4 UUIDs’ randomness), as URL-safe base64 without padding.

request_line 🔒

A connection’s request, read whole (its line, then its headers up to the blank line that ends them) within LINE_TIME and LINE_BYTES, Cancel heard between reads: its request line. None when it does not come whole in time, or when Cancel is pressed meanwhile. A request that ends with the connection’s own end after its line (a tool, not a browser) counts whole.

wait 🔒

Waits at the door for the provider’s answer, at most deadline, or until stop (Cancel): judge says what each answer means and which page the browser shows. The code, else why there is none.