andy/blackwall-auth-sdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

docs: include consent-time access_denied for inactive accounts

Browse Source 
Clarify that provider-side active-account enforcement can reject OAuth consent submission when account status changes during the authorization session.
This commit is contained in:
Andy Dixon
2026-02-26 12:26:45 +00:00
parent df7ca1329e
commit d97638201e
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/INTEGRATION_GUIDE.md
+1
View File
@@ -139,6 +139,7 @@ try {
Provider login/authorization steps can also fail with `access_denied` when account status is disabled before completion. Provider login/authorization steps can also fail with `access_denied` when account status is disabled before completion.
WebAuthn-based login verification can return credential-style failures for disabled accounts even when authenticator assertions are otherwise valid. WebAuthn-based login verification can return credential-style failures for disabled accounts even when authenticator assertions are otherwise valid.
Existing authenticated sessions may also be invalidated when account status changes to disabled. Existing authenticated sessions may also be invalidated when account status changes to disabled.
OAuth authorization consent submission can return `access_denied` if the account becomes inactive between session establishment and consent completion.
## Operational guidance ## Operational guidance