| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
[Server] Narrow authorization to the resource server role (#532) * [Server] Narrow authorization to the resource server role * Remove OAuthProxyMiddleware, ClientRegistrationMiddleware and their interfaces (ADR 0002) * Replace OAuthRequestMetaMiddleware with RequestContext::getAccessToken() * Add ScopePolicy to AuthorizationMiddleware for 403 insufficient_scope step-up * JwtTokenValidator: final, CachedKeySet with refetch on unknown kid, alg allowlist, token type, leeway * ProtectedResourceMetadata: require resource, derive metadata path and challenge URL from it, enforce https * Expose WWW-Authenticate via CORS * [Server] Answer unresolvable token signing keys with 401 * [Server] Reject access tokens without exp * [Server] Discover issuer keys lazily, one key set per algorithm Keys without alg are tagged with the token's algorithm instead of the first allowed one. * [Server] Document the access token parameter BC breaks * [Server] Dedupe scopes on insert in ScopePolicy * [Server] Hand on implied scopes with the access token * [Server] Challenge other authorization schemes without error code * [Server] Explain bearer parsing and header escaping * [Server] Keep the resource query in the protected resource metadata URL * [Server] Cover SecureUrl and forbidden batch requests * [Docs] Document the AccessToken request attribute as integration seam * [Examples] Note that Entra step-up needs the prefixed scope * [Server] Require a numeric exp in access tokens * [Server] Expand the scope hierarchy once per request * [Server] Share scope validation between policy and metadata * [Server] Back off briefly after a failed OIDC discovery * [Server] Note the global leeway swap in JwtTokenValidator * [Server] Accept only https, or http on loopback hosts, in SecureUrl * [Server] Serve metadata of a queryless resource only without query * [Server] Restrict scopes to the RFC 6749 scope-token grammar * [Server] Keep the resource path verbatim in the metadata URL * [Server] Resolve the signing key before swapping the JWT leeway | 7 天前 | |
[Server] Narrow authorization to the resource server role (#532) * [Server] Narrow authorization to the resource server role * Remove OAuthProxyMiddleware, ClientRegistrationMiddleware and their interfaces (ADR 0002) * Replace OAuthRequestMetaMiddleware with RequestContext::getAccessToken() * Add ScopePolicy to AuthorizationMiddleware for 403 insufficient_scope step-up * JwtTokenValidator: final, CachedKeySet with refetch on unknown kid, alg allowlist, token type, leeway * ProtectedResourceMetadata: require resource, derive metadata path and challenge URL from it, enforce https * Expose WWW-Authenticate via CORS * [Server] Answer unresolvable token signing keys with 401 * [Server] Reject access tokens without exp * [Server] Discover issuer keys lazily, one key set per algorithm Keys without alg are tagged with the token's algorithm instead of the first allowed one. * [Server] Document the access token parameter BC breaks * [Server] Dedupe scopes on insert in ScopePolicy * [Server] Hand on implied scopes with the access token * [Server] Challenge other authorization schemes without error code * [Server] Explain bearer parsing and header escaping * [Server] Keep the resource query in the protected resource metadata URL * [Server] Cover SecureUrl and forbidden batch requests * [Docs] Document the AccessToken request attribute as integration seam * [Examples] Note that Entra step-up needs the prefixed scope * [Server] Require a numeric exp in access tokens * [Server] Expand the scope hierarchy once per request * [Server] Share scope validation between policy and metadata * [Server] Back off briefly after a failed OIDC discovery * [Server] Note the global leeway swap in JwtTokenValidator * [Server] Accept only https, or http on loopback hosts, in SecureUrl * [Server] Serve metadata of a queryless resource only without query * [Server] Restrict scopes to the RFC 6749 scope-token grammar * [Server] Keep the resource path verbatim in the metadata URL * [Server] Resolve the signing key before swapping the JWT leeway | 7 天前 | |
[Server] Narrow authorization to the resource server role (#532) * [Server] Narrow authorization to the resource server role * Remove OAuthProxyMiddleware, ClientRegistrationMiddleware and their interfaces (ADR 0002) * Replace OAuthRequestMetaMiddleware with RequestContext::getAccessToken() * Add ScopePolicy to AuthorizationMiddleware for 403 insufficient_scope step-up * JwtTokenValidator: final, CachedKeySet with refetch on unknown kid, alg allowlist, token type, leeway * ProtectedResourceMetadata: require resource, derive metadata path and challenge URL from it, enforce https * Expose WWW-Authenticate via CORS * [Server] Answer unresolvable token signing keys with 401 * [Server] Reject access tokens without exp * [Server] Discover issuer keys lazily, one key set per algorithm Keys without alg are tagged with the token's algorithm instead of the first allowed one. * [Server] Document the access token parameter BC breaks * [Server] Dedupe scopes on insert in ScopePolicy * [Server] Hand on implied scopes with the access token * [Server] Challenge other authorization schemes without error code * [Server] Explain bearer parsing and header escaping * [Server] Keep the resource query in the protected resource metadata URL * [Server] Cover SecureUrl and forbidden batch requests * [Docs] Document the AccessToken request attribute as integration seam * [Examples] Note that Entra step-up needs the prefixed scope * [Server] Require a numeric exp in access tokens * [Server] Expand the scope hierarchy once per request * [Server] Share scope validation between policy and metadata * [Server] Back off briefly after a failed OIDC discovery * [Server] Note the global leeway swap in JwtTokenValidator * [Server] Accept only https, or http on loopback hosts, in SecureUrl * [Server] Serve metadata of a queryless resource only without query * [Server] Restrict scopes to the RFC 6749 scope-token grammar * [Server] Keep the resource path verbatim in the metadata URL * [Server] Resolve the signing key before swapping the JWT leeway | 7 天前 |
Architecture Decision Records
This directory holds Architecture Decision Records (ADRs): short documents that capture a significant architectural decision, the context that led to it, and its consequences. They exist so a decision can be cited once and referenced thereafter — for example, when declining a pull request that conflicts with an accepted decision.