[Intro] Yo, listen up, lemme run it back Loopback, local port, inna di track (Ay!) Crew, say "PORT!" (PORT!) [Verse 1] Shared machine, a process sit quiet, yuh see? Pick a port, claim di app identity User sign in inna di browser, calm and nice But di callback land wid di wrong one, what a price! Authorisation code a fly, so where it land? Loopback only tell yuh destination, understand? [Chorus] Di port nuh safe, di port nuh safe! Check di rule, don't take it for granted Registered port, requested port, mek di comparison straight Di port nuh safe, di port nuh safe! PKCE guard di code, but it nuh guard di door Who fi get di callback? Check it, mek sure! [Verse 2] Omit di port, and di server accept 8080, accept 80 too Register 8080, it reject 9080 an' 80, yuh feel me, true? Scheme change from HTTP to HTTPS? Nah, rejected too Port flexibility nuh mean disregard di whole URI, ya hear? Hardcode di exact URLs, no wildcard trap Document di port handling separate, like a map [Bridge] (Percussion only, spoken) Destination, not identity... Browser sign-in, then di token exchange... Listener need a route, or di callback endpoint... Auth0 seh another app on di same machine could listen... Check di acceptance rules, every single one... [Chorus] Di port nuh safe, di port nuh safe! Check di rule, don't take it for granted Registered port, requested port, mek di comparison straight Di port nuh safe, di port nuh safe! PKCE guard di code, but it nuh guard di door Who fi get di callback? Check it, mek sure! [Outro] Di port nuh safe... Crew: "Check it!" Di port nuh safe... Crew: "Check it!" Mek sure, mek sure...
