GameCult/Heimdall
Watch
9
0
Fork
You've already forked Heimdall
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Heimdall/docs
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Heimdall c829429cd5 Google link is two-phase; callback evaluates all linked identities 
The callback records a typed pending link (short TTL, single use) and
writes no linked identity; POST /v1/apps/:appSlug/links/confirm with the
Heimdall access token of the initiating account attaches it. A victim who
completes an attacker's link URL attaches nothing. The sign-in callback
also evaluates the account's other linked identities with the start-time
policy, so a Discord-origin member returning via Google keeps app_access.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-04 17:15:33 +00:00
..
app-profiles Joystick custody needs a creator binding, at start and at the callback 2026-10-19 14:34:24 +02:00
architecture.md Docs: map managed credential custody, the callback mint and the open follow-ups 2026-10-19 15:49:34 +02:00
eve-access-plugin.md Add Eve access plugin and private auth plane 2026-08-22 00:44:57 +02:00
implementation-plan.md Docs: map managed credential custody, the callback mint and the open follow-ups 2026-10-19 15:49:34 +02:00
service-contract.md Google link is two-phase; callback evaluates all linked identities 2026-11-04 17:15:33 +00:00
verse-service-contract.md Add Eve access plugin and private auth plane 2026-08-22 00:44:57 +02:00