Trong Huu Nguyen 4b56c77ddb fix(openid/client): refuse redirects for credential-bearing requests ...

Requests to the token and pushed authorization endpoints carry the
client secret or a signed client assertion. Following a redirect would
forward those credentials to a host the provider never advertised.

2026-07-28 11:43:53 +02:00

..

client_test.go

feat(openid/client): set nbf claim for client assertions

2026-06-09 10:00:22 +02:00

client.go

fix(openid/client): refuse redirects for credential-bearing requests

2026-07-28 11:43:53 +02:00

login_callback_test.go

refactor(openid/client): remove indirection layer for login callback

2025-01-21 09:39:23 +01:00

login_callback.go

feat: set more session and token-related span attributes

2025-06-10 13:51:15 +02:00

login_test.go

feat(openid): support domain_hint for authorization grant

2026-03-03 09:38:24 +01:00

login.go

feat(openid): support domain_hint for authorization grant

2026-03-03 09:38:24 +01:00

logout_callback_test.go

feat(openid, handler): support runtime override of redirect after single-logout

2023-05-04 14:45:13 +02:00

logout_callback.go

refactor(openid): use pkce implementation from golang.org/x/oauth2

2023-10-10 10:18:01 +02:00

logout_test.go

feat(openid): support logout_hint for RP-initiated logouts

2026-01-16 09:18:30 +01:00

logout.go

feat(openid): support logout_hint for RP-initiated logouts

2026-01-16 09:18:30 +01:00