indiko
my own indieAuth provider! indiko.dunkirk.sh/docs
indieauth oauth2-server
Star
Fork
Watch

Commits on main
docs: update the conformance numbers after the refresh-token run
committed
feat: let people choose to stay signed in to IndieAuth apps
committed
docs: link the passing indieauth.rocks conformance report
committed
fix: keep long redirect URIs from spilling out of the error page
committed
fix: let signed-in pages recover from a stale CSRF cookie
committed
fix: make userinfo match the token response profile for IndieAuth clients
committed
fix: grant the deploy workflow read access to the repository
committed
feat: link the full client URL on the consent screen
committed
docs: update about indiko
committed
fix: show the branded error page for every authorization failure
committed
docs: record the October security review and current conventions
committed
fix: make app revocation real and bound untrusted input
committed
feat: pass the indieauth.rocks server test suite
committed
fix: close login, session, and LDAP gaps found in security review
committed
feat: serve agent-readable site metadata and public content pages
committed
docs: sync registration and discovery docs with current behavior
committed
feat: allow public clients to register without a secret
committed
fix: authenticate confidential clients on the device grant
committed
docs: cover resource indicators, rate limits, and current discovery metadata
committed
fix: require consent for newly requested resource indicators
committed
feat: advertise openid in AS metadata scopes_supported
committed
feat: advertise revocation_endpoint in AS metadata
committed
chore: fix required placement
committed
chore: run biome check --write
committed
style: match consent resource block to the page's visual vocabulary
committed
feat: RFC 8707 resource indicators (token audience binding)
committed
bug: fix button spacing issues
committed
feat: respect redirect url in conditional passkey flow
committed
feat: fix refresh token expiry
committed
feat: fix scope checkboxes
committed
chore: correct device auth page tokens
committed
feat: devie flow is public
committed
chore: fix device page
committed
chore: fix headers
committed
security: fix authcode/device races, user status checks, and misc hardening
committed
security: close CSRF gaps, rate limit bypasses, and SSRF IPv6 holes
committed
security: migrate browser auth from localStorage to HttpOnly cookies
committed
security: fix stored XSS in admin pages and open redirect
committed
security: fix session, LDAP, and rate limiting gaps
committed
security: fix SSRF DNS validation and device code brute force
committed
security: harden OAuth/OIDC token handling
committed
security: fix critical auth flow vulnerabilities
committed
bug: add proper preload to keep test data in mem
committed
feat: show conditional passkey ui
committed
feat: add passkey name modal
committed
feat: redesign admin pages
committed
feat: add seed script
committed
test: cover oidc key generation on a fresh install
committed
avycado13
fix key generation
committed
feat: tighten client id metadata document (CIMD) compliance
committed
feat: dynamic client registration (RFC 7591)
committed
feat: only issue refresh tokens when offline_access is requested
committed
feat: detect refresh token reuse and revoke the token family
committed
feat: use timing safe comparison
committed
bug: return iss on errors
committed
bug: fix biome issues
committed
chore: remove oauth tester page
committed
feat: docs overhaul
committed
feat: add device registration
committed
feat: show me param in consent screen
committed