andy/blackwall-auth-sdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity
54 Commits 1 Branch 8 Tags
d287e01b2ace77c8b019873bf96711720c992135
Commit Graph
31 Commits
Author SHA1 Message Date
Andy Dixon b2163ad996 Default allow_missing_nonce behavior 2026-04-27 10:50:50 +01:00
Andy Dixon 1d8578c1da Additional Improvements 2026-03-11 07:41:21 +00:00
Andy Dixon 986dc95646 Updated to enforce nonce in example and documentaion 2026-03-10 09:50:34 +00:00
Andy Dixon 6b67bf574d typo 2026-02-26 13:40:48 +00:00
Andy Dixon fc80ee1659 docs: add provider security model for sdk integrators 
Introduces security-model guidance covering provider invariants, expected auth failure modes, and integration-safe handling.
 2026-02-26 13:38:45 +00:00
Andy Dixon 1d62f0affd docs: document refresh invalid_grant on scope tightening 
Adds integration guidance that refresh-token exchange may fail after provider-side client scope policy is narrowed.
 2026-02-26 13:34:42 +00:00
Andy Dixon ddc08270a7 docs: document invalid_scope handling and scope allowlist alignment 
Clarifies that requested SDK scopes must be enabled on the provider OAuth client and adds callback-handling guidance for invalid_scope failures.
 2026-02-26 13:30:07 +00:00
Andy Dixon 32208c7701 docs: note cryptbin credential-binding requirements 
Document that new cryptbin items can enforce creating-credential binding for unwrap/update/delete operations in addition to key proof.
 2026-02-26 13:25:20 +00:00
Andy Dixon 62544d86b4 docs: add CIDR trusted-proxy guidance 
Clarify trusted-proxy configuration can use explicit IP/CIDR entries and should remain narrowly scoped for abuse-control integrity.
 2026-02-26 13:23:29 +00:00
Andy Dixon 35d58ff07b docs: add CSV import limit guidance for bulk admin flows 
Document operational expectations for CSV file-size and row-count limits during provider bulk-user import automation.
 2026-02-26 13:17:28 +00:00
Andy Dixon 464524da27 docs: note serialized decision behavior for approval actions 
Clarify that approve/reject/cancel decisions for a single approval request should be treated as serialized and not submitted in parallel.
 2026-02-26 13:16:32 +00:00
Andy Dixon 8bb3c1ce12 docs: note JWT revocation-aware userinfo behavior 
Update integration guidance that revoked JWT access tokens are now rejected on provider userinfo before natural expiry.
 2026-02-26 13:00:51 +00:00
Andy Dixon bbcada1317 docs: clarify idempotent retry expectations for approval flows 
Document serialized approval execution expectations and recommend bounded idempotent client retries for admin mutation workflows.
 2026-02-26 12:58:50 +00:00
Andy Dixon 878e2b98e6 docs: add reverse-proxy IP header hardening guidance 
Document strict trusted-proxy configuration requirements to avoid spoofed client IP forwarding affecting abuse controls.
 2026-02-26 12:42:10 +00:00
Andy Dixon 6cc2ddabd0 docs: require non-URL handling for enrollment links 
Clarify that enrollment URLs are sensitive bearer material and must not be transported in redirect query strings or logs.
 2026-02-26 12:40:33 +00:00
Andy Dixon fb60a1eccb docs: document introspection active=false on disabled subjects 
Clarify SDK integration guidance that provider introspection can return active=false when user/project/client is disabled after token issuance.
 2026-02-26 12:38:45 +00:00
Andy Dixon ebea82f63d docs: add CSV export formula-injection handling guidance 
Document that provider CSV exports should be handled with formula-injection safety when opened in spreadsheet tooling.
 2026-02-26 12:35:02 +00:00
Andy Dixon 3d3493e546 docs: require POST+CSRF for admin enrollment export calls 
Document provider hardening change: enrollment URL export is state-changing and must be invoked with POST plus CSRF token, not GET links.
 2026-02-26 12:33:51 +00:00
Andy Dixon 822b9b93c5 docs: document cryptbin unwrap key proof requirement 
Update SDK security guidance/examples to note that provider cryptbin unwrap calls must include key_b64url and now fail with 403 Forbidden on key mismatch.
 2026-02-26 12:31:11 +00:00
Andy Dixon f9323110ce docs: prohibit URL query transport of secrets and tokens 
Update SDK security guidance to explicitly forbid placing client secrets or bearer tokens in URL query strings, matching provider-side hardening against secret leakage.
 2026-02-26 12:02:21 +00:00
Andy Dixon cb0bd43d04 docs: clarify end-user integrations should use OAuth/portal endpoints 
Add guidance that admin authentication endpoints are scope-restricted and not intended for end-user SDK integrations.
 2026-02-26 11:52:41 +00:00
Andy Dixon 066a0b8fb7 docs: require HTTPS redirect URIs except localhost loopback dev 
Align SDK integration guidance with provider redirect URI hardening: use HTTPS callback URLs in production and limit HTTP callbacks to localhost loopback during development/testing.
 2026-02-26 11:46:31 +00:00
Andy Dixon d8a28dea12 docs: document consent-time access_denied from provider revalidation 
Clarify that providers may return access_denied at callback time even after consent UI is shown, when membership/tenant scope changes before consent submission. This aligns integration guidance with current provider-side security enforcement.
 2026-02-26 11:38:13 +00:00
Andy Dixon f529714f45 docs: handle OAuth callback access_denied outcomes from stricter provider authz 
Update SDK docs and example callback handling to process provider callback errors explicitly. access_denied is now documented and handled as an expected authorization outcome (HTTP 403), including cases where provider membership/scope checks fail at consent submission.
 2026-02-26 11:36:17 +00:00
Andy Dixon 6ddbcaec70 docs: add OIDC nonce guidance and callback error handling 2026-02-26 11:11:47 +00:00
Andy Dixon 3ff5b7aa26 Security hardening: enforce secure URLs and transport safeguards 2026-02-26 09:10:09 +00:00
Andy Dixon 94c85fc8d5 Release 1.0.1: normalized userinfo and callback helper 2026-02-26 09:07:11 +00:00
Andy Dixon 1c7b7b6717 Update package name in installation instructions 2026-02-23 09:35:39 +00:00
Andy Dixon 1ed5bd6bd3 Changed base blackwall URL 2026-02-13 13:51:59 +00:00
Andy Dixon bbbc2dffae Update README.md 2026-02-10 09:21:19 +00:00
Andy Dixon 57637840a5 Initial Commit 2026-02-10 09:17:22 +00:00