andy/blackwall-auth-sdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

docs: note session invalidation behavior for disabled accounts

Browse Source 
Document that provider-side account disablement can invalidate existing authenticated sessions, not just new login attempts.
This commit is contained in:
Andy Dixon
2026-02-26 12:22:20 +00:00
parent 8b7f11fc6a
commit df7ca1329e
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/INTEGRATION_GUIDE.md
+1
View File
@@ -138,6 +138,7 @@ try {
`TokenExchangeException` with `invalid_grant` can also occur when provider-side client/user/project state is inactive at exchange time. `TokenExchangeException` with `invalid_grant` can also occur when provider-side client/user/project state is inactive at exchange time.
Provider login/authorization steps can also fail with `access_denied` when account status is disabled before completion. Provider login/authorization steps can also fail with `access_denied` when account status is disabled before completion.
WebAuthn-based login verification can return credential-style failures for disabled accounts even when authenticator assertions are otherwise valid. WebAuthn-based login verification can return credential-style failures for disabled accounts even when authenticator assertions are otherwise valid.
Existing authenticated sessions may also be invalidated when account status changes to disabled.
## Operational guidance ## Operational guidance