andy/blackwall-auth-sdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity
38 Commits 1 Branch 8 Tags
fb60a1eccbe45f1316f21b0cc811d30e8603417a
Commit Graph
16 Commits
Author SHA1 Message Date
Andy Dixon fb60a1eccb docs: document introspection active=false on disabled subjects 
Clarify SDK integration guidance that provider introspection can return active=false when user/project/client is disabled after token issuance.
 2026-02-26 12:38:45 +00:00
Andy Dixon ebea82f63d docs: add CSV export formula-injection handling guidance 
Document that provider CSV exports should be handled with formula-injection safety when opened in spreadsheet tooling.
 2026-02-26 12:35:02 +00:00
Andy Dixon 3d3493e546 docs: require POST+CSRF for admin enrollment export calls 
Document provider hardening change: enrollment URL export is state-changing and must be invoked with POST plus CSRF token, not GET links.
 2026-02-26 12:33:51 +00:00
Andy Dixon 822b9b93c5 docs: document cryptbin unwrap key proof requirement 
Update SDK security guidance/examples to note that provider cryptbin unwrap calls must include key_b64url and now fail with 403 Forbidden on key mismatch.
 2026-02-26 12:31:11 +00:00
Andy Dixon f9323110ce docs: prohibit URL query transport of secrets and tokens 
Update SDK security guidance to explicitly forbid placing client secrets or bearer tokens in URL query strings, matching provider-side hardening against secret leakage.
 2026-02-26 12:02:21 +00:00
Andy Dixon cb0bd43d04 docs: clarify end-user integrations should use OAuth/portal endpoints 
Add guidance that admin authentication endpoints are scope-restricted and not intended for end-user SDK integrations.
 2026-02-26 11:52:41 +00:00
Andy Dixon 066a0b8fb7 docs: require HTTPS redirect URIs except localhost loopback dev 
Align SDK integration guidance with provider redirect URI hardening: use HTTPS callback URLs in production and limit HTTP callbacks to localhost loopback during development/testing.
 2026-02-26 11:46:31 +00:00
Andy Dixon d8a28dea12 docs: document consent-time access_denied from provider revalidation 
Clarify that providers may return access_denied at callback time even after consent UI is shown, when membership/tenant scope changes before consent submission. This aligns integration guidance with current provider-side security enforcement.
 2026-02-26 11:38:13 +00:00
Andy Dixon f529714f45 docs: handle OAuth callback access_denied outcomes from stricter provider authz 
Update SDK docs and example callback handling to process provider callback errors explicitly. access_denied is now documented and handled as an expected authorization outcome (HTTP 403), including cases where provider membership/scope checks fail at consent submission.
 2026-02-26 11:36:17 +00:00
Andy Dixon 6ddbcaec70 docs: add OIDC nonce guidance and callback error handling 2026-02-26 11:11:47 +00:00
Andy Dixon 3ff5b7aa26 Security hardening: enforce secure URLs and transport safeguards 2026-02-26 09:10:09 +00:00
Andy Dixon 94c85fc8d5 Release 1.0.1: normalized userinfo and callback helper 2026-02-26 09:07:11 +00:00
Andy Dixon 1c7b7b6717 Update package name in installation instructions 2026-02-23 09:35:39 +00:00
Andy Dixon 1ed5bd6bd3 Changed base blackwall URL 2026-02-13 13:51:59 +00:00
Andy Dixon bbbc2dffae Update README.md 2026-02-10 09:21:19 +00:00
Andy Dixon 57637840a5 Initial Commit 2026-02-10 09:17:22 +00:00