From 8bb3c1ce12249c733387e46a662bacbf9dfed137 Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Thu, 26 Feb 2026 13:00:51 +0000 Subject: [PATCH] docs: note JWT revocation-aware userinfo behavior Update integration guidance that revoked JWT access tokens are now rejected on provider userinfo before natural expiry. --- README.md | 1 + docs/INTEGRATION_GUIDE.md | 1 + 2 files changed, 2 insertions(+) diff --git a/README.md b/README.md index d233755..d4f33ae 100644 --- a/README.md +++ b/README.md @@ -131,6 +131,7 @@ This wrapper now delegates to `BlackWall\Auth\AuthClient`. - Handle provider callback errors (`error`, `error_description`) explicitly; treat `access_denied` as an expected user/authorisation outcome rather than a transport failure. - Expect `access_denied` even after the consent page is displayed if provider-side project membership or tenant scope changes before consent submission. - Expect provider token introspection to return `active=false` when user/project/client state is no longer active. +- Expect revoked JWT access tokens to be rejected by provider `userinfo` even before token expiry. - Register only HTTPS redirect URIs in provider client settings (HTTP should be used only for localhost loopback during development). - Use OAuth/portal authentication endpoints for end users; provider admin login endpoints enforce separate admin scope checks. - For provider admin enrollment URL export operations, use `POST` with CSRF protection; do not automate them via unauthenticated `GET` links. diff --git a/docs/INTEGRATION_GUIDE.md b/docs/INTEGRATION_GUIDE.md index cd4d186..5278a93 100644 --- a/docs/INTEGRATION_GUIDE.md +++ b/docs/INTEGRATION_GUIDE.md @@ -137,6 +137,7 @@ try { `UserInfoException` with `invalid_token` can occur when provider-side subject scope is no longer active (for example user/project disabled) between token issuance and userinfo retrieval. `TokenExchangeException` with `invalid_grant` can also occur when provider-side client/user/project state is inactive at exchange time. Token introspection can return `active=false` when the token subject (user/project) or client has since been disabled. +Provider JWT access tokens are now revocation-aware at `userinfo`; revoked JWTs can fail before natural expiry. Provider login/authorization steps can also fail with `access_denied` when account status is disabled before completion. WebAuthn-based login verification can return credential-style failures for disabled accounts even when authenticator assertions are otherwise valid. Existing authenticated sessions may also be invalidated when account status changes to disabled.