diff --git a/src/auth/auth.controller.ts b/src/auth/auth.controller.ts
index 247f491..2520c4e 100644
--- a/src/auth/auth.controller.ts
+++ b/src/auth/auth.controller.ts
@@ -8,6 +8,7 @@ import { ApiBearerAuth } from '@nestjs/swagger';
 import { SetPasswordDto } from './dto/createPassword.dto';
 import { Response } from 'express';
 import { WhiteDto } from './dto/whiteList.dto';
+import { GoogleAuthGuard } from './google-auth.guard';
 
 interface Update{
     id:string;
@@ -102,7 +103,7 @@ export class AuthController {
 
   // auth.controller.ts
   @Get('google/callback')
-  @UseGuards(AuthGuard('google'))
+  @UseGuards(GoogleAuthGuard)
   async googleCallback(@Req() req, @Res() res: Response) {
     const user = req.user;
 
@@ -119,6 +120,8 @@ export class AuthController {
     return res.redirect(
       `${process.env.FRONTEND_URL}/oauth-callback?token=${jwt.access_token}`,
     );
+    
+
   }
 
   
diff --git a/src/auth/google-auth.guard.ts b/src/auth/google-auth.guard.ts
new file mode 100644
index 0000000..2e095c5
--- /dev/null
+++ b/src/auth/google-auth.guard.ts
@@ -0,0 +1,19 @@
+// google-auth.guard.ts
+import { Injectable } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+
+@Injectable()
+export class GoogleAuthGuard extends AuthGuard('google') {
+  handleRequest(err: any, user: any, info: any, context: any) {
+    const req = context.switchToHttp().getRequest();
+    const res = context.switchToHttp().getResponse();
+
+    if (err || !user) {
+      // 👇 siempre redirigir al front en caso de error
+      res.redirect(`${process.env.FRONTEND_URL}?error=oauth_failed`);
+      return null;
+    }
+
+    return user;
+  }
+}
diff --git a/src/auth/google.strategy.ts b/src/auth/google.strategy.ts
index 47c079c..fa1685b 100644
--- a/src/auth/google.strategy.ts
+++ b/src/auth/google.strategy.ts
@@ -16,6 +16,7 @@ export class GoogleStrategy extends PassportStrategy(Strategy, 'google') {
       clientSecret: config.get<string>('GOOGLE_CLIENT_SECRET'),
       callbackURL: config.get<string>('GOOGLE_CALLBACK_URL'),
       scope: ['email', 'profile'],
+      failureRedirect: `${process.env.FRONTEND_URL}?error=oauth_failed`,
     });
   }
 
@@ -25,15 +26,19 @@ export class GoogleStrategy extends PassportStrategy(Strategy, 'google') {
     profile: any,
     done: VerifyCallback,
   ): Promise<any> {
+    try{
     const { emails } = profile;
     const email = emails[0].value;
 
     const user = await this.authService.validateGoogleUser(email);
 
     if (!user) {
-      throw new UnauthorizedException('Usuario no registrado en el sistema');
+      done(null, false);
     }
 
     done(null, user);
+    }catch(err){
+      done(null, false);
+    }
   }
 }
diff --git a/src/main.ts b/src/main.ts
index 326a05e..1613c54 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -13,7 +13,11 @@ import { SwaggerModule, DocumentBuilder } from '@nestjs/swagger';
 
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
-  app.enableCors({ exposedHeaders: ['Content-Disposition'] });
+   app.enableCors({
+    origin: ['https://venus.acatlan.unam.mx/servicios_pcpuma'], // solo frontend permitido
+    methods: 'GET,HEAD,PUT,PATCH,POST,DELETE',
+    credentials: true,
+  });
 
   app.useGlobalPipes(
     new ValidationPipe({