andy/blackwall-auth-sdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

docs: specify POST-only usage for provider WebAuthn challenge/verify endpoints

Browse Source 
Clarify integration expectations that provider-side WebAuthn login challenge and verify endpoints should be invoked via POST methods only.
This commit is contained in:
Andy Dixon
2026-02-26 11:40:31 +00:00
parent 7d0319332f
commit d4a6418e5d
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/INTEGRATION_GUIDE.md
+1
View File
@@ -139,6 +139,7 @@ try {
- Keep provider URLs in environment variables, not hard-coded. - Keep provider URLs in environment variables, not hard-coded.
- Avoid printing tokens in production pages. - Avoid printing tokens in production pages.
- Expect `429 Too Many Requests` from provider control endpoints under abuse protection; implement backoff/retry instead of tight loops. - Expect `429 Too Many Requests` from provider control endpoints under abuse protection; implement backoff/retry instead of tight loops.
- If you call provider WebAuthn login challenge/verify endpoints directly, use `POST` only.
- Rotate client secrets for confidential clients. - Rotate client secrets for confidential clients.
- Add a unique `nonce` to each OIDC authorisation request. - Add a unique `nonce` to each OIDC authorisation request.
- Validate `state` on every callback request. - Validate `state` on every callback request.