Skip to content

feat(auto-authn): warn and omit insecure grant types #3450

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

feat(auto-authn): warn and omit insecure grant types #3450

wants to merge 1 commit into from

Conversation

@cobycloud
Copy link
Contributor

Summary

  • warn and reject Resource Owner Password Credentials and implicit token flows
  • drop insecure grant types from OIDC metadata
  • test password grant and implicit response types are unsupported

Testing

  • uv run --directory standards/auto_authn --package auto_authn ruff format .
  • uv run --directory standards/auto_authn --package auto_authn ruff check . --fix
  • uv run --directory standards/auto_authn --package auto_authn pytest

https://chatgpt.com/codex/tasks/task_e_68ac93eff7008326a3c5a9ad102c0a14

Base automatically changed from coby/peagenv2-aapi_colspecs to coby/peagenv2 August 28, 2025 11:50
Base automatically changed from coby/peagenv2 to mono/dev August 29, 2025 22:27
Base automatically changed from mono/dev to master September 13, 2025 20:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

codex

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@cobycloud