Repository navigation
feat(oidc): enforce OAuth 2.1 and RFC 9700 defaults #410
Description
Why
Secure defaults that do not need tuning.
What
- PKCE required for every client
- No implicit or resource owner password grant
- Exact redirect URI matching
- Refresh rotation or sender constraint
- Documented in the RFC 9700 matrix
Done when
Insecure configurations cannot be created, and the matrix shows each item enforced.
Activity
Bccorb commentedon Oct 30, 2026
Architecture for this is settled in ADR 0001 (#520). The OpenID Provider runs in a separate public login edge (new repo, seamless-auth-oidc-provider) that signs users in through the first-party routes. The auth API stays private and cookie-free. See D1 (locked configuration on the edge), D6 and D12 (the API refuses insecure client settings).
Bccorb commentedon Nov 1, 2026
Shipped in v0.21.0. The edge locks the configuration to the OAuth 2.1 and RFC 9700 defaults (seamless-auth-oidc-provider#15 and #21) and the API refuses insecure client settings. PKCE is required by default and no implicit or password grant exists. The one documented exception is a per-application PKCE and nonce opt-out for confidential clients only (seamless-auth-oidc-provider#28, API #540), which the OpenID conformance plans need; CI checks on every run that a client without the opt-out still refuses a request lacking
code_challenge. The matrix is under "Security Defaults" in the guide. Closing.