-
Notifications
You must be signed in to change notification settings - Fork 20
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
Narrow the TOTP skew window so future-period codes are not accepted
enhancementNew feature or requestNew feature or requestgoPull requests that update Go codePull requests that update Go codesecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#142 In leodip/goiabada;ClearAuthContext is called after the client response is committed in seven handlers, so the clear reaches nothing
bugSomething isn't workingSomething isn't workinggoPull requests that update Go codePull requests that update Go codesecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#141 In leodip/goiabada;Security: a session-less completion inherits the previous session's amr, claiming otp that did not happen
bugSomething isn't workingSomething isn't workinggoPull requests that update Go codePull requests that update Go codesecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#140 In leodip/goiabada;Security: a code insert can land between a termination's UPDATE and its COMMIT, escaping both marks
bugSomething isn't workingSomething isn't workinggoPull requests that update Go codePull requests that update Go codesecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#139 In leodip/goiabada;Security: the code exchange reveals generation and disabled-user state before the requester authenticates
bugSomething isn't workingSomething isn't workinggoPull requests that update Go codePull requests that update Go codesecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#137 In leodip/goiabada;Flaky: TestSearchUsersPaginated collides with accumulated users in the never-reset shared databases
bugSomething isn't workingSomething isn't workinggoPull requests that update Go codePull requests that update Go codeStatus: Open.#136 In leodip/goiabada;Add a client-scoped "disconnect this application" revocation capability
enhancementNew feature or requestNew feature or requestgoPull requests that update Go codePull requests that update Go codeStatus: Open.#135 In leodip/goiabada;Security: an authorization ceremony can bind to a session belonging to a different user
bugSomething isn't workingSomething isn't workinggoPull requests that update Go codePull requests that update Go codesecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#133 In leodip/goiabada;Make refresh-token family containment atomic with rotation
bugSomething isn't workingSomething isn't workingsecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#132 In leodip/goiabada;Refresh rotation is not coordinated with user-scoped generation changes, so a preserved session can be handed an unusable token
bugSomething isn't workingSomething isn't workingenhancementNew feature or requestNew feature or requestStatus: Open.#131 In leodip/goiabada;Bug: used-code cleanup deletes nothing when a ROPC refresh token exists (NOT IN with NULL code_id)
bugSomething isn't workingSomething isn't workingStatus: Open.#130 In leodip/goiabada;AuditROPCAuthFailed is declared but never logged: emit it at a safe boundary or remove it
enhancementNew feature or requestNew feature or requestgoPull requests that update Go codePull requests that update Go codeStatus: Open.#126 In leodip/goiabada;