andy/blackwall-auth-sdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

docs: require non-URL handling for enrollment links

Browse Source 
Clarify that enrollment URLs are sensitive bearer material and must not be transported in redirect query strings or logs.
This commit is contained in:
Andy Dixon
2026-02-26 12:40:33 +00:00
parent fb60a1eccb
commit 6cc2ddabd0
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1
View File
@@ -135,6 +135,7 @@ This wrapper now delegates to `BlackWall\Auth\AuthClient`.
- Use OAuth/portal authentication endpoints for end users; provider admin login endpoints enforce separate admin scope checks. - Use OAuth/portal authentication endpoints for end users; provider admin login endpoints enforce separate admin scope checks.
- For provider admin enrollment URL export operations, use `POST` with CSRF protection; do not automate them via unauthenticated `GET` links. - For provider admin enrollment URL export operations, use `POST` with CSRF protection; do not automate them via unauthenticated `GET` links.
- Handle provider CSV exports with formula-injection safety in mind if opening them in spreadsheet applications. - Handle provider CSV exports with formula-injection safety in mind if opening them in spreadsheet applications.
- Treat generated enrollment URLs as secrets and keep them out of URL query strings and request logs.
- Never place client secrets, refresh tokens, or access tokens in URL query strings. - Never place client secrets, refresh tokens, or access tokens in URL query strings.
- For OIDC providers, include a per-request `nonce` in authorisation requests. - For OIDC providers, include a per-request `nonce` in authorisation requests.
- For direct Cryptbin API usage, send `key_b64url` on unwrap calls; provider rejects key-mismatch unwrap attempts with `403 Forbidden`. - For direct Cryptbin API usage, send `key_b64url` on unwrap calls; provider rejects key-mismatch unwrap attempts with `403 Forbidden`.
docs/INTEGRATION_GUIDE.md
+1
View File
@@ -154,6 +154,7 @@ Provider user/project assignment views may exclude disabled projects even if his
- If you call provider WebAuthn login challenge/verify endpoints directly, use `POST` only. - If you call provider WebAuthn login challenge/verify endpoints directly, use `POST` only.
- Treat admin enrollment URL export as a state-changing operation: call it with `POST` and include a valid CSRF token. - Treat admin enrollment URL export as a state-changing operation: call it with `POST` and include a valid CSRF token.
- Treat provider CSV exports as untrusted input in spreadsheet tools; prefer importing into systems that neutralise formula cells. - Treat provider CSV exports as untrusted input in spreadsheet tools; prefer importing into systems that neutralise formula cells.
- Treat enrollment URLs as sensitive bearer material: do not place them in redirect query parameters, logs, or analytics tags; keep them in one-time server-side flash/session state.
- Configure OAuth client redirect URIs as HTTPS in production; reserve HTTP for localhost loopback testing only. - Configure OAuth client redirect URIs as HTTPS in production; reserve HTTP for localhost loopback testing only.
- Assume provider rate limits are enforced per source identity (for example IP) and shared across related auth endpoints. - Assume provider rate limits are enforced per source identity (for example IP) and shared across related auth endpoints.
- Treat report/export-style provider endpoints as high-cost and expect stricter rate limits. - Treat report/export-style provider endpoints as high-cost and expect stricter rate limits.