Dissect a RequestExplorerStudy guideBuild it

Dissect a request

Take each SecurePay request apart. Every piece: what it means → who handles it → what you build (green BUILD box). Orange = new in this hop, green = carried from an earlier hop.

The formula (tap to open)

Works for any question

  1. Find the hop the question is about (which two parties talk?).
  2. Say WHO sends, WHERE it goes, what it CARRIES, what the receiver CHECKS (name the Spring class), what it RETURNS.
  3. Finish with what carries to the next hop — or how it fails.

Security rules: the browser carries only public or one-time values (client_id, state, code); secrets and tokens go server-to-server. The Auth Server signs tokens; A and B only verify them locally with its public key. Every protected request ends as Authentication → controller, 401 (who are you?) or 403 (not allowed).

NEWFROM HOP nPUBLICSECRETONE-TIMESIGNEDSET BY SPRING