Photographer Website
Full-stack photo sharing with a hand-rolled OAuth flow.
A Next.js photo-sharing site whose interesting half is the auth: a hand-rolled OAuth flow against Firebase and the Adobe APIs, with cryptographic state validation and HTTP-only signed cookies. Adobe handles image processing; GitHub Actions ships it to Firebase Hosting.
The auth
The interesting half of this project is the login. Rather than lean on a drop-in provider widget, the site runs a custom OAuth flow against Firebase Auth and the Adobe APIs.
That means owning the parts a widget would have hidden: cryptographic state validation so an authorization response cannot be forged or replayed across sessions, and HTTP-only signed cookies so the session token is never reachable from client-side script. Those two together are what close the CSRF and XSS paths that a hand-rolled flow otherwise leaves open.
The rest of the stack
The interface is React and Next.js with a responsive TailwindCSS layout. Adobe handles upload and image processing, Firebase Storage holds the data, and GitHub Actions deploys the whole stack to Firebase Hosting on push.
- Custom OAuth flow against Firebase Auth and the Adobe APIs.
- CSRF and XSS hardening: cryptographic state validation, HTTP-only signed cookies.
- Deployed by GitHub Actions to Firebase Hosting.