title: In Spring-boot-oauth, how come Google is able to hit my local "http://localhost:8080/login/oauth2/code/google" callback end-point?
body: <p>I am using spring security to authenticate with Google. I am following this: <a href="https://github.com/kriscfoster/SpringOAuth2Demo" rel="nofollow noreferrer">https://github.com/kriscfoster/SpringOAuth2Demo</a>. Please see below for the main pieces of the logic to enable oauth2login. Everything is working as expected.</p>
  <p>I do see - for Google authentication, Spring-boot-oauth client while invoking Google end-point (<a href="https://accounts.google.com/o/oauth2/v2/auth" rel="nofollow noreferrer">https://accounts.google.com/o/oauth2/v2/auth</a>), passing my spring-boot app's local end-point: http://localhost:8080/login/oauth2/code/google as redirect URI. And Google in-return after authentication passing <strong>authroization_code</strong> to the redirect URI (in this case: http://localhost:8080/login/oauth2/code/google).</p>
  <p><strong>Question</strong></p>
  <ol>
  <li><p>This may be basic, but how come Google is able to hit my localhost endpoint? (the redirect URI - documentation says - The redirect URI is the path in the application that the end-user’s user-agent is redirected back to after they have authenticated with Google. But I don't know what it means by <strong>end-user’s user-agent is redirected back to</strong>. Looks like it does mean, Google is not calling back <strong>localhost</strong>  - rather something to do with browser/http protocol.</p>
  </li>
  <li><p>Can someone please point me to the code reference that's serving the redirect URI (localhost:8080/login/oauth2/code/google)?</p>
  <pre><code> spring.security.oauth2.client.registration.google.client-id=&lt;my client ID&gt;
   spring.security.oauth2.client.registration.google.client-secret=&lt;my client secret&gt;
  </code></pre>
  <p><strong>// Spring security configuration</strong></p>
  <pre><code> http.antMatcher(&quot;/**&quot;).authorizeRequests()
           .antMatchers(new String[]{&quot;/&quot;, &quot;/not-restricted&quot;}).permitAll()
           .anyRequest().authenticated()
           .and()
           .oauth2Login();
  </code></pre>
  </li>
  </ol>
  <p><strong>// POM dependencies</strong></p>
  <pre><code>   &lt;dependency&gt;
                  &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
                  &lt;artifactId&gt;spring-boot-starter-oauth2-client&lt;/artifactId&gt;
              &lt;/dependency&gt;
              &lt;dependency&gt;
                  &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
                  &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
              &lt;/dependency&gt;
              &lt;dependency&gt;
                  &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
                  &lt;artifactId&gt;spring-boot-starter-web&lt;/artifactId&gt;
              &lt;/dependency&gt;
  </code></pre>