From ba8868cc12b872cd2237a9b199cc107094a13f77 Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Thu, 26 Feb 2026 12:28:11 +0000 Subject: [PATCH] docs: note stricter limits on high-cost report/export endpoints Extend integration guidance to account for stricter abuse controls on provider report/export style endpoints. --- docs/INTEGRATION_GUIDE.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/INTEGRATION_GUIDE.md b/docs/INTEGRATION_GUIDE.md index a8ad31b..6c163fa 100644 --- a/docs/INTEGRATION_GUIDE.md +++ b/docs/INTEGRATION_GUIDE.md @@ -153,6 +153,7 @@ Provider user/project assignment views may exclude disabled projects even if his - If you call provider WebAuthn login challenge/verify endpoints directly, use `POST` only. - Configure OAuth client redirect URIs as HTTPS in production; reserve HTTP for localhost loopback testing only. - Assume provider rate limits are enforced per source identity (for example IP) and shared across related auth endpoints. +- Treat report/export-style provider endpoints as high-cost and expect stricter rate limits. - Rotate client secrets for confidential clients. - Do not transport secrets or tokens in URL query parameters; keep them in server-side session or secure storage only. - Add a unique `nonce` to each OIDC authorisation request.