3f88f6c388
Two paths, one session. The GSI popup posts an ID token to /student/google; where a popup is refused a PKCE authorization-code flow redeems server side at /student/google/callback, keeping the client secret out of the browser. ID tokens are verified here rather than trusted from the browser: RS256 signature against Google's published JWKS (cached an hour), audience pinned to this client, issuer restricted to Google, expiry enforced, email must be verified. State is single use and expires in ten minutes. Without GOOGLE_CLIENT_ID the button is hidden and the email form is offered instead. 13 tests cover the verification rules using locally generated RSA keys, including rejection of a foreign signature, a wrong audience, a wrong issuer, an expired token and a rewritten payload. An example signs a token from an untrusted key so the rejection path can be checked without a Google account.
13 lines
No EOL
1.3 KiB
HTML
13 lines
No EOL
1.3 KiB
HTML
<p class="meta">This is a study tool built as a working copy of an existing practice site. Using it means you accept these terms.</p>
|
||
<h3>What the service does</h3>
|
||
<p class="meta">It builds practice papers from a bank of JEE Main style questions, runs them on a timed screen with +4 and −1 marking, and keeps your submitted papers so you can review results.</p>
|
||
<h3>Your account</h3>
|
||
<p class="meta">Signing in with Google attaches your papers to that Google account, verified server side, so they follow you to another device. The email form does not check that you own the address, so treat an account made that way as a practice account and do not use it for anything you would mind losing.</p>
|
||
<h3>Question accuracy</h3>
|
||
<p class="meta">Questions, answers and solutions are study material and may contain errors. Treat a wrong answer key as a bug, not a fact, and check anything you plan to rely on.</p>
|
||
<h3>Acceptable use</h3>
|
||
<p class="meta">No scraping at scale, no automated bulk paper generation, no attempts to reach other students' papers. Personal practice only.</p>
|
||
<h3>No warranty</h3>
|
||
<p class="meta">The service is provided as is, with no promise that it will be available or error free.</p>
|
||
<h3>Changes</h3>
|
||
<p class="meta">Terms can change as the tool does. The version in this file is the one that applies.</p> |