Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Meta Vens d695674359 Heimdall sign-in: redact the app secret from client logging, expire the attempt cookie at its path, bound the return path ... - The HeimdallAuthService client redacts x-heimdall-app-secret from HTTP client logging at every level; a Trace canary test pins it. - The attempt cookie's deletion carries its Path and no Max-Age (which outranks the 1970 expiry); pinned on success and refusal paths. - LocalReturnPath is at most 256 characters, else /App, so the attempt cookie stays far below the browser limit; pinned at the bound and with the heaviest-escaping path. - A set BaseUrl with a blank AppSlug is refused at Start before any Heimdall call; behavioural test. Builds untested until the verification job at the end of this batch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>		2026-10-11 08:58:19 +02:00
..
HeimdallTestKit.cs	Heimdall sign-in: redact the app secret from client logging, expire the attempt cookie at its path, bound the return path	2026-10-11 08:58:19 +02:00
TestAuthHandler.cs	Initial Scaffold	2026-04-21 20:08:49 +01:00
TestWebApplicationFactory.cs	Heimdall token verifier: one process-wide instance owns the key cache	2026-10-11 02:55:35 +02:00