| 14 months ago |
Kim Alvefur |
mod_http_oauth2: Reduce log level for error delivery via redirect
|
| 14 months ago |
Kim Alvefur |
mod_http_oauth2: Tweak fallback error text
|
| 14 months ago |
Kim Alvefur |
mod_http_oauth2: Improve registration schema documentation parts
|
| 15 months ago |
Kim Alvefur |
mod_http_oauth2: Do not enforce PKCE on Device and OOB flows
|
| 15 months ago |
Kim Alvefur |
mod_http_oauth2: Add logger to "session" for auth event
|
| 15 months ago |
Kim Alvefur |
mod_http_oauth2: Move some code earlier
|
| 15 months ago |
Kim Alvefur |
mod_http_oauth2: Reject unparsable URLs
|
| 15 months ago |
Kim Alvefur |
mod_http_oauth2: Return validation output added in trunk rev 72d7830505f0
|
| 15 months ago |
Kim Alvefur |
mod_http_oauth2: Handle login_hint without @hostpart
|
| 15 months ago |
Kim Alvefur |
mod_http_oauth2: Fire authentication events on login form
|
| 15 months ago |
Kim Alvefur |
mod_http_oauth2: Comment on authorization code storage
|
| 16 months ago |
Kim Alvefur |
mod_http_oauth2: Make defaults more secure
|
| 16 months ago |
Kim Alvefur |
mod_http_oauth2: Skip consent screen if requested by client and same scopes already granted
|
| 16 months ago |
Kim Alvefur |
mod_http_oauth2: Limit revocation to clients own tokens in strict mode
|
| 16 months ago |
Kim Alvefur |
mod_http_oauth2: Restrict introspection to clients own tokens
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Implement introspection endpoint
|
| 17 months ago |
Kim Alvefur |
mod_http_oauth2: Include 'amr' claim in ID Token
|
| 18 months ago |
Kim Alvefur |
mod_http_oauth2: Apply refresh token ttl to refresh token instead of grant
|
| 18 months ago |
Kim Alvefur |
mod_http_oauth2: Allow 'login_hint' as a substitute for OIDC 'select_account' prompt
|
| 18 months ago |
Kim Alvefur |
mod_http_oauth2: Remove broken in-CSS templating
|
| 19 months ago |
Kim Alvefur |
mod_http_oauth2: Allow omitting application type for native apps
|
| 19 months ago |
Kim Alvefur |
mod_http_oauth2: Make storage of various code more consistent
|
| 19 months ago |
Kim Alvefur |
mod_http_oauth2: Bail on invalid or expired device flow state token
|
| 19 months ago |
Kim Alvefur |
mod_http_oauth2: Optionally enforce authentication on revocation endpoint
|
| 19 months ago |
Kim Alvefur |
mod_http_oauth2: Don't use new time period API just yet
|
| 19 months ago |
Kim Alvefur |
mod_http_oauth2: Clean cache less frequently
|
| 19 months ago |
Kim Alvefur |
mod_http_oauth2: Shorten default token validity periods
|
| 19 months ago |
Kim Alvefur |
mod_http_oauth2: Implement refresh token rotation
|
| 20 months ago |
Kim Alvefur |
mod_http_oauth2: Allow a shorter form of the device grant in config
|
| 20 months ago |
Kim Alvefur |
mod_http_oauth2: Show errors on device flow user code entry page
|
| 20 months ago |
Kim Alvefur |
mod_http_oauth2: Namespace the various codes to minimize confusion
|
| 20 months ago |
Kim Alvefur |
mod_http_oauth2: Improve a description in schema
|
| 20 months ago |
Kim Alvefur |
mod_http_oauth2: Add titles and descriptions to registration schema
|
| 20 months ago |
Kim Alvefur |
mod_http_oauth2: Implement RFC 8628 Device Authorization Grant
|
| 20 months ago |
Kim Alvefur |
mod_http_oauth2: Only add nonce when issuing a client_secret
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Strip JWKS metadata since we do not understand that
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Strip unknown client metadata
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Make allowed locales configurable
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Improve error messages for URI properties
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Make note about handling repeated
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Add TODO about disabling password grant
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Disable CORS for authorization endpoint
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Make CSP configurable
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Remove underscore prefix
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Simplify template using if-falsy operator
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Return Authentication Time per OpenID Core Section 2
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Validate the OpenID 'prompt' parameter
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Revert strict form check to allow consent of multiple scopes
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Reject duplicate form-urlencoded parameters
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Bind refresh tokens to client
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Record hash of client_id to allow future verification
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Add client verification wrapper function
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Add Cache-Control and Pragma headers per by RFC 6749
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Add provisions for dynamically adding simple scopes
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Sort imports
|
| 21 months ago |
Kim Alvefur |
mod_http_oauth2: Create proper template for OOB code delivery
|
