docs: handle OAuth callback access_denied outcomes from stricter provider authz

Update SDK docs and example callback handling to process provider callback errors explicitly. access_denied is now documented and handled as an expected authorization outcome (HTTP 403), including cases where provider membership/scope checks fail at consent submission.
2026-02-26 11:36:17 +00:00
parent 6ddbcaec70
commit f529714f45
3 changed files with 14 additions and 1 deletions
@@ -128,6 +128,7 @@ This wrapper now delegates to `BlackWall\Auth\AuthClient`.
 ## Security notes

 - Always validate OAuth `state` in callback handlers.
+- Handle provider callback errors (`error`, `error_description`) explicitly; treat `access_denied` as an expected user/authorisation outcome rather than a transport failure.
 - For OIDC providers, include a per-request `nonce` in authorisation requests.
 - Always use HTTPS in production.
 - Store refresh tokens securely.