andy/blackwall-auth-sdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

docs: clarify provider rate limits may be source-identity scoped

Browse Source 
Add integration guidance that provider abuse controls can apply across related auth endpoints based on source identity, reinforcing backoff and retry discipline.
This commit is contained in:
Andy Dixon
2026-02-26 11:53:25 +00:00
parent cb0bd43d04
commit 12cefe68e8
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/INTEGRATION_GUIDE.md
+1
View File
@@ -145,6 +145,7 @@ try {
- For token exchange and refresh, apply bounded retry/backoff on transient provider failures instead of immediate repeated retries. - For token exchange and refresh, apply bounded retry/backoff on transient provider failures instead of immediate repeated retries.
- If you call provider WebAuthn login challenge/verify endpoints directly, use `POST` only. - If you call provider WebAuthn login challenge/verify endpoints directly, use `POST` only.
- Configure OAuth client redirect URIs as HTTPS in production; reserve HTTP for localhost loopback testing only. - Configure OAuth client redirect URIs as HTTPS in production; reserve HTTP for localhost loopback testing only.
- Assume provider rate limits are enforced per source identity (for example IP) and shared across related auth endpoints.
- Rotate client secrets for confidential clients. - Rotate client secrets for confidential clients.
- Add a unique `nonce` to each OIDC authorisation request. - Add a unique `nonce` to each OIDC authorisation request.
- Validate `state` on every callback request. - Validate `state` on every callback request.