From d4a6418e5d3714a1cc02351192b2d3b0eecbab45 Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Thu, 26 Feb 2026 11:40:31 +0000 Subject: [PATCH] docs: specify POST-only usage for provider WebAuthn challenge/verify endpoints Clarify integration expectations that provider-side WebAuthn login challenge and verify endpoints should be invoked via POST methods only. --- docs/INTEGRATION_GUIDE.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/INTEGRATION_GUIDE.md b/docs/INTEGRATION_GUIDE.md index fd78674..f61332c 100644 --- a/docs/INTEGRATION_GUIDE.md +++ b/docs/INTEGRATION_GUIDE.md @@ -139,6 +139,7 @@ try { - Keep provider URLs in environment variables, not hard-coded. - Avoid printing tokens in production pages. - Expect `429 Too Many Requests` from provider control endpoints under abuse protection; implement backoff/retry instead of tight loops. +- If you call provider WebAuthn login challenge/verify endpoints directly, use `POST` only. - Rotate client secrets for confidential clients. - Add a unique `nonce` to each OIDC authorisation request. - Validate `state` on every callback request.