andy/blackwall-auth-sdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

typo

Browse Source
This commit is contained in:
Andy Dixon
2026-02-26 13:40:48 +00:00
parent fc80ee1659
commit 6b67bf574d
4 changed files with 11 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/SECURITY_MODEL.md
+1 -1
View File
@@ -23,5 +23,5 @@ This document summarises provider-side security guarantees that SDK integrators
- Keep requested scopes minimal and aligned to the provider client configuration.
- Treat `access_denied`, `invalid_scope`, and `invalid_grant` as expected security outcomes, not transport errors.
- Build retries only for transient failures; do not blindly retry authz/authn denials.
- Keep enrollment URLs/tokens and OAuth tokens out of URLs, logs, and analytics tags.
- Keep enrolment URLs/tokens and OAuth tokens out of URLs, logs, and analytics tags.
- Use strict HTTPS and secure session-cookie handling in the relying party app.