andy/blackwall-auth-sdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

docs: note stricter limits on high-cost report/export endpoints

Browse Source 
Extend integration guidance to account for stricter abuse controls on provider report/export style endpoints.
This commit is contained in:
Andy Dixon
2026-02-26 12:28:11 +00:00
parent 78606bf751
commit ba8868cc12
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/INTEGRATION_GUIDE.md
+1
View File
@@ -153,6 +153,7 @@ Provider user/project assignment views may exclude disabled projects even if his
- If you call provider WebAuthn login challenge/verify endpoints directly, use `POST` only. - If you call provider WebAuthn login challenge/verify endpoints directly, use `POST` only.
- Configure OAuth client redirect URIs as HTTPS in production; reserve HTTP for localhost loopback testing only. - Configure OAuth client redirect URIs as HTTPS in production; reserve HTTP for localhost loopback testing only.
- Assume provider rate limits are enforced per source identity (for example IP) and shared across related auth endpoints. - Assume provider rate limits are enforced per source identity (for example IP) and shared across related auth endpoints.
- Treat report/export-style provider endpoints as high-cost and expect stricter rate limits.
- Rotate client secrets for confidential clients. - Rotate client secrets for confidential clients.
- Do not transport secrets or tokens in URL query parameters; keep them in server-side session or secure storage only. - Do not transport secrets or tokens in URL query parameters; keep them in server-side session or secure storage only.
- Add a unique `nonce` to each OIDC authorisation request. - Add a unique `nonce` to each OIDC authorisation request.