andy/blackwall-auth-sdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

docs: document cryptbin unwrap key proof requirement

Browse Source 
Update SDK security guidance/examples to note that provider cryptbin unwrap calls must include key_b64url and now fail with 403 Forbidden on key mismatch.
This commit is contained in:
Andy Dixon
2026-02-26 12:31:11 +00:00
parent ba8868cc12
commit 822b9b93c5
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/INTEGRATION_GUIDE.md
+1
View File
@@ -162,3 +162,4 @@ Provider user/project assignment views may exclude disabled projects even if his
- Use secure session cookies (`Secure`, `HttpOnly`, `SameSite=Lax` or stricter).
- HTTPS URLs are enforced by default in `Config::fromArray()`.
- For localhost-only HTTP testing, explicitly set `allowInsecureHttp => true`.
- If you call Cryptbin unwrap APIs directly, include the original share key as `key_b64url`; unwrap now returns `403 Forbidden` when key proof does not match metadata verifier.