go-pkgz / auth

86%

master: 86%

LAST BUILD ON BRANCH fix/documented-auth-params

branch: fix/documented-auth-params

CHANGE BRANCH

x

Reset

• fix/documented-auth-params
• allowed-provider-check
• apple-reponse-mode-fix
• aud-secrets
• ava-factory
• avatar-errnotfound
• chore/go-fix
• ci/codeql-v2
• ci/go-1.26-golangci-2.12
• configurable-microsoft-tenant
• cookie-domain
• custom-dev-host
• custom-dev-port
• dependabot/go_modules/_example/github.com/go-chi/chi/v5-5.2.2
• dependabot/go_modules/_example/golang.org/x/crypto-0.17.0
• dependabot/go_modules/_example/golang.org/x/image-0.38.0
• dependabot/go_modules/_example/golang.org/x/image-0.5.0
• dependabot/go_modules/_example/golang.org/x/net-0.17.0
• dependabot/go_modules/_example/golang.org/x/net-0.7.0
• dependabot/go_modules/golang.org/x/crypto-0.31.0
• dependabot/go_modules/golang.org/x/image-0.38.0
• dependabot/go_modules/golang.org/x/image-0.41.0
• dependabot/go_modules/v2/github.com/golang-jwt/jwt/v5-5.2.2
• dependabot/go_modules/v2/golang.org/x/crypto-0.31.0
• dependabot/go_modules/v2/golang.org/x/crypto-0.45.0
• dependabot/go_modules/v2/golang.org/x/crypto-0.52.0
• dependabot/go_modules/v2/golang.org/x/image-0.41.0
• dependabot/go_modules/v2/golang.org/x/net-0.33.0
• dependabot/go_modules/v2/golang.org/x/net-0.36.0
• deps-refresh
• direct-custom-id
• docs/comment-sweep
• docs/microsoft-signin-audience
• dverhoturov/telegram_fix
• email-send-context
• email-sender
• feat/csrf-middleware
• feat/github-numeric-id
• feat/partitioned-cookies
• feat/sender-helo-host
• feat/telegram-api-url
• feature/custom-error-handler
• fix-anon
• fix-content-type-header
• fix-oauth-from-open-redirect
• fix-oauth-sendjwtheader
• fix-providers-names
• fix/admin-passwd-log-leak
• fix/apple-id-token-iss-aud
• fix/apple-jwk-cache
• fix/apple-log-redact-token-response
• fix/auth-sensitive-logging
• fix/avatar-content-type-spoofing-xss
• fix/csp-consumer-note
• fix/dev-custom-bind-localhost
• fix/email-sender-redact-body
• fix/go127-image-assertions
• fix/go127-test-assertions
• fix/gridfs-concurrent-put
• fix/gridfs-revisions
• fix/nil-avatar-store
• fix/panic-save-ava-nil
• fix/see-other-redirect-after-auth
• fix/telegram-redact-bot-token-in-avatar-url
• fix/v1-from-redirect-validator
• fix/verify-replay
• fix/verify-replay-typed-nil-followup
• followups/security-review
• go1_20
• jwt-header
• master
• microsoft
• migrate-example-to-routegroup
• no-ava
• official-mongo-drvier
• paskal/HttpOnly
• paskal/add_common_processor
• paskal/avatar_return_proper_content_type
• paskal/bump_ci_go_version
• paskal/bump_dep
• paskal/bump_go_modules
• paskal/bump_modules
• paskal/double_close
• paskal/email_module
• paskal/facelift
• paskal/fix_actions_test
• paskal/fix_apple_key_panic
• paskal/fix_custom_server
• paskal/fix_error
• paskal/fix_golangcilint
• paskal/fix_lint_report
• paskal/fix_send_jwt_header
• paskal/google_auth_doc
• paskal/improve_telegram
• paskal/modules_bump
• paskal/mongodb
• paskal/moq
• paskal/new_errors
• paskal/plain_text
• paskal/switch_to_v2
• paskal/sync_v2
• paskal/telegram_site_id
• paskal/tg_username
• paskal/token_generation_instructions
• paskal/update-dependencies
• paskal/update-modules
• paskal/update_modules
• paskal/update_pkcs8
• paskal/v2
• paskal/v2_golangcilint
• paskal/v2_jwt5
• ps/fix-example
• rbac
• refs/tags/v0.10.0
• refs/tags/v0.10.1
• refs/tags/v0.10.2
• refs/tags/v0.11.0
• refs/tags/v0.12.0
• refs/tags/v0.12.1
• refs/tags/v1.13.0
• refs/tags/v1.13.1
• refs/tags/v1.14.0
• refs/tags/v1.15.0
• refs/tags/v1.16.0
• refs/tags/v1.17.0
• refs/tags/v1.18.0
• refs/tags/v1.19.0
• refs/tags/v1.19.1
• refs/tags/v1.20.0
• refs/tags/v1.21.0
• refs/tags/v1.22.0
• refs/tags/v1.22.1
• refs/tags/v1.23.0
• refs/tags/v1.24.0
• refs/tags/v1.24.1
• refs/tags/v1.24.2
• refs/tags/v1.25.1
• refs/tags/v1.25.2
• refs/tags/v1.25.3
• refs/tags/v1.25.4
• refs/tags/v1.25.5
• refs/tags/v1.25.6
• refs/tags/v1.25.7
• refs/tags/v1.26.0
• refs/tags/v1.5.1
• refs/tags/v2.0.0
• refs/tags/v2.1.0
• refs/tags/v2.1.1
• refs/tags/v2.1.2
• refs/tags/v2.1.3
• refs/tags/v2.1.4
• refs/tags/v2.1.5
• refs/tags/v2.1.6
• refs/tags/v2.1.7
• refs/tags/v2.2.0
• remove-bluemonday
• samesite
• sanitize-verifyed
• update-dependencies-2026-04
• update-dependencies-dec2024
• update-deps-and-golangci-v2
• upgrade-repeater-v2
• v0.8.0
• v0.8.1
• v0.8.2
• v0.8.3
• v0.9.0
• verify-avatar

Build # 32187327183

Build Type

Pull #307

github

Committed by paskal

Commit Message

Honor documented session and audience parameters

Previously, the direct and verify providers read the session-only flag from
sess while README documented session, the verify provider read the site id
from site while README documented aud, and the Apple callback dropped the
SessionOnly flag carried by its own handshake claims and always issued a
persistent cookie.

Both spellings are now accepted on every provider, aud falls back to site,
and Apple propagates SessionOnly the way the oauth1 and oauth2 callbacks
already do.

Pull Request Pull Request #307: fix: honor documented session and audience parameters

Coverage Stats

18 of 18 new or added lines in 6 files covered. (100.0%)

3085 of 3607 relevant lines covered (85.53%)

8.83 hits per line