Opt-in sign_in step-up (force_verify / prompt=login), app-authenticated, signed-state flag #11

Merged

heimdall merged 2 commits from heimdall/signin-step-up into main 2026-11-12 23:22:19 +00:00

Conversation 0 Commits 2 Files changed 7 +304 -14

2026-11-12

Heimdall

Step-up: build the authorize URL before claiming the launch (a refused step-up no longer burns the state); pin the strict step_up parse with a signed forgery; document backend_callback and mixed-version limits ...

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

673713a015

• View at this point in history

2026-11-12 23:21:12 +00:00

Heimdall

Opt-in sign_in step-up: app-authenticated, signed-state flag, provider re-auth parameters, typed refusal ...

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

7a69d7567b

• View at this point in history

2026-11-12 23:10:27 +00:00