|
mod_http_oauth2: Fix check for userinfo endpoint handler
|
Kim Alvefur |
5 months ago |
|
mod_http_oauth2: Fix error due to mistake in 5f8a306c8306
|
Kim Alvefur |
6 months ago |
|
mod_http_oauth2: Simplify negation in condition
|
Kim Alvefur |
7 months ago |
|
mod_http_oauth2: Require a stringprepped host part of URLs
|
Kim Alvefur |
7 months ago |
|
mod_http_oauth2: Ensure URL ports are integer in correct range
|
Kim Alvefur |
7 months ago |
|
mod_http_oauth2: Reject URLs with 'userinfo' part (thanks mimi89999)
|
Kim Alvefur |
7 months ago |
|
mod_http_oauth2: Guard against malformed authorization header
|
Kim Alvefur |
8 months ago |
|
mod_http_oauth2: HTTP authentication schemes are case-insensitive
|
Kim Alvefur |
8 months ago |
|
mod_http_oauth2: Reflect changes to defaults etc
|
Kim Alvefur |
13 months ago |
|
mod_http_oauth2: Reuse JWT issuance time as substitute for auth time
|
Kim Alvefur |
14 months ago |
|
mod_http_oauth2: Reduce log level for error delivery via redirect
|
Kim Alvefur |
15 months ago |
|
mod_http_oauth2: Tweak fallback error text
|
Kim Alvefur |
15 months ago |
|
mod_http_oauth2: Improve registration schema documentation parts
|
Kim Alvefur |
15 months ago |
|
mod_http_oauth2: Do not enforce PKCE on Device and OOB flows
|
Kim Alvefur |
15 months ago |
|
mod_http_oauth2: Add logger to "session" for auth event
|
Kim Alvefur |
16 months ago |
|
mod_http_oauth2: Move some code earlier
|
Kim Alvefur |
16 months ago |
|
mod_http_oauth2: Reject unparsable URLs
|
Kim Alvefur |
16 months ago |
|
mod_http_oauth2: Return validation output added in trunk rev 72d7830505f0
|
Kim Alvefur |
16 months ago |
|
mod_http_oauth2: Handle login_hint without @hostpart
|
Kim Alvefur |
16 months ago |
|
mod_http_oauth2: Fire authentication events on login form
|
Kim Alvefur |
16 months ago |
|
mod_http_oauth2: Comment on authorization code storage
|
Kim Alvefur |
16 months ago |
|
mod_http_oauth2: Make defaults more secure
|
Kim Alvefur |
16 months ago |
|
mod_http_oauth2: Skip consent screen if requested by client and same scopes already granted
|
Kim Alvefur |
16 months ago |
|
mod_http_oauth2: Limit revocation to clients own tokens in strict mode
|
Kim Alvefur |
17 months ago |
|
mod_http_oauth2: Restrict introspection to clients own tokens
|
Kim Alvefur |
17 months ago |
|
mod_http_oauth2: Implement introspection endpoint
|
Kim Alvefur |
22 months ago |
|
mod_http_oauth2: Include 'amr' claim in ID Token
|
Kim Alvefur |
18 months ago |
|
mod_http_oauth2: Apply refresh token ttl to refresh token instead of grant
|
Kim Alvefur |
18 months ago |
|
mod_http_oauth2: Allow 'login_hint' as a substitute for OIDC 'select_account' prompt
|
Kim Alvefur |
18 months ago |
|
mod_http_oauth2: Remove broken in-CSS templating
|
Kim Alvefur |
19 months ago |
|
mod_http_oauth2: Allow omitting application type for native apps
|
Kim Alvefur |
19 months ago |
|
mod_http_oauth2: Make storage of various code more consistent
|
Kim Alvefur |
20 months ago |
|
mod_http_oauth2: Bail on invalid or expired device flow state token
|
Kim Alvefur |
20 months ago |
|
mod_http_oauth2: Optionally enforce authentication on revocation endpoint
|
Kim Alvefur |
20 months ago |
|
mod_http_oauth2: Don't use new time period API just yet
|
Kim Alvefur |
20 months ago |
|
mod_http_oauth2: Clean cache less frequently
|
Kim Alvefur |
20 months ago |
|
mod_http_oauth2: Shorten default token validity periods
|
Kim Alvefur |
20 months ago |
|
mod_http_oauth2: Implement refresh token rotation
|
Kim Alvefur |
20 months ago |
|
mod_http_oauth2: Allow a shorter form of the device grant in config
|
Kim Alvefur |
20 months ago |
|
mod_http_oauth2: Show errors on device flow user code entry page
|
Kim Alvefur |
20 months ago |
|
mod_http_oauth2: Namespace the various codes to minimize confusion
|
Kim Alvefur |
20 months ago |
|
mod_http_oauth2: Improve a description in schema
|
Kim Alvefur |
20 months ago |
|
mod_http_oauth2: Add titles and descriptions to registration schema
|
Kim Alvefur |
20 months ago |
|
mod_http_oauth2: Implement RFC 8628 Device Authorization Grant
|
Kim Alvefur |
20 months ago |
|
mod_http_oauth2: Only add nonce when issuing a client_secret
|
Kim Alvefur |
21 months ago |
|
mod_http_oauth2: Strip JWKS metadata since we do not understand that
|
Kim Alvefur |
21 months ago |
|
mod_http_oauth2: Strip unknown client metadata
|
Kim Alvefur |
21 months ago |
|
mod_http_oauth2: Make allowed locales configurable
|
Kim Alvefur |
21 months ago |
|
mod_http_oauth2: Improve error messages for URI properties
|
Kim Alvefur |
21 months ago |
|
mod_http_oauth2: Make note about handling repeated
|
Kim Alvefur |
21 months ago |
|
mod_http_oauth2: Add TODO about disabling password grant
|
Kim Alvefur |
21 months ago |
|
mod_http_oauth2: Disable CORS for authorization endpoint
|
Kim Alvefur |
21 months ago |
|
mod_http_oauth2: Make CSP configurable
|
Kim Alvefur |
21 months ago |
|
mod_http_oauth2: Remove underscore prefix
|
Kim Alvefur |
21 months ago |
|
mod_http_oauth2: Simplify template using if-falsy operator
|
Kim Alvefur |
22 months ago |
|
mod_http_oauth2: Return Authentication Time per OpenID Core Section 2
|
Kim Alvefur |
22 months ago |
|
mod_http_oauth2: Validate the OpenID 'prompt' parameter
|
Kim Alvefur |
22 months ago |
|
mod_http_oauth2: Revert strict form check to allow consent of multiple scopes
|
Kim Alvefur |
22 months ago |
|
mod_http_oauth2: Reject duplicate form-urlencoded parameters
|
Kim Alvefur |
22 months ago |
|
mod_http_oauth2: Bind refresh tokens to client
|
Kim Alvefur |
22 months ago |
