indieweb/indieauth

View on GitHub

IndieAuth.net website code and IndieAuth Specification

Stars: 57
Forks: 7
Open beginner issues: 0
Indexed issues: 37

Dominant language: HTML
License: No license data
Last GitHub push: Jul 11, 2024
Latest indexed: Sep 17, 2026
Contributing guide: No contributing guide
Code of conduct: No code of conduct
Beginner labels: No beginner labels indexed
PR merge metrics: No merged PRs in 30d

Open All

37 open issues indexed

Link relations in HTTP Link header conflict with RFC 5988. Open

indieweb/indieauth#17 · 5 comments · 1 reaction · 0 assignees · Indexed Sep 17, 2026
recommend/require Accept-headers, and show them in examples Open

indieweb/indieauth#18 · 9 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Should the use of explicit app schemes be discouraged as redirectUrls? Open

indieweb/indieauth#20 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Create architecture diagram Open

indieweb/indieauth#26 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Create a Detailed Application Diagram Open

indieweb/indieauth#27 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Write up Data Flow Enumeration Open

indieweb/indieauth#28 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Write up threat analysis Open

indieweb/indieauth#29 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Which WWW-Authenticate header to use? Open

indieweb/indieauth#32 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Document URL update procedures Open

indieweb/indieauth#34 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Path component in client_id considered optional Open

indieweb/indieauth#38 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Adopt Pushed Authorization Requests Open

revisit later

indieweb/indieauth#40 · 5 comments · 1 reaction · 0 assignees · Indexed Sep 17, 2026
IndieAuth needs non-normative Privacy Threat Model documentation Open

indieweb/indieauth#63 · 0 comments · 3 reactions · 0 assignees · Indexed Sep 17, 2026
Clarify what an AS should display if no app information was discovered at the client ID URL Open

indieweb/indieauth#64 · 1 comment · 1 reaction · 0 assignees · Indexed Sep 17, 2026
Adopt Resource Indicators or similar system to limit token access to resources Open

revisit later

indieweb/indieauth#82 · 7 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Should a token grant access to anything more specific than the specified resource? Open

ticketing extension

indieweb/indieauth#83 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Do we need to add client_id to ticket auth requests? Open

ticketing extension

indieweb/indieauth#85 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Standard mechanism for requesting a ticket auth ticket grant? Open

ticketing extension

indieweb/indieauth#87 · 11 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Extension to Allow Clients to Get Tokens Secured by Ticket Open

ticketing extension

indieweb/indieauth#88 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Issuing Access Tokens for Introspection Open

indieweb/indieauth#99 · 7 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Expressly Note a TLS/HTTPS requirement Open

indieweb/indieauth#103 · 1 comment · 2 reactions · 0 assignees · Indexed Sep 17, 2026
reference RFC 9207 instead of draft-ietf-oauth-iss-auth-resp Open

indieweb/indieauth#112 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
ticketing + ac-obo Open

indieweb/indieauth#113 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 17, 2026
Text improvement for §6.2 Access Token Verification Response Open

indieweb/indieauth#115 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Clarify properties in access token grant response description and example Open

indieweb/indieauth#116 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Include Cache-Control and Pragma headers in token exchange response example Open

indieweb/indieauth#117 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Discourage use of insecure HTTP for client_id and redirect_uri? Open

indieweb/indieauth#119 · 3 comments · 1 reaction · 0 assignees · Indexed Sep 17, 2026
Require explicitly specifying `redirect_uri` instead of allowing same-host URIs by default? Open

indieweb/indieauth#122 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Application Information is web application specific Open

indieweb/indieauth#123 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Add Device Flow / Device Authorization Grant Open

indieweb/indieauth#124 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Add Microsub as a conformance class Open

indieweb/indieauth#125 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Note that the Issuer Identifier URL Should Have the Metadata Headers Open

indieweb/indieauth#128 · 9 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Add Extension Registry URL to spec. Open

indieweb/indieauth#130 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Usage of the Me Parameter in the Access Token Response Open

indieweb/indieauth#132 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Update client information discovery method Open

indieweb/indieauth#133 · 28 comments · 3 reactions · 0 assignees · Indexed Sep 17, 2026
Should `indieauth-metadata` be discoverable by DNS? Open

indieweb/indieauth#134 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Any testing tools available? Open

indieweb/indieauth#137 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 17, 2026
Is it legal to omit the `access_token`? Open

indieweb/indieauth#140 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 17, 2026

indieweb/indieauth

Get new issues in your inbox