|
|
366edf55d9
|
skills/onyva-login/SKILL.md aktualisiert
Major SKILL.md update: lessons learned from real integrations
- Add IdP-initiated SSO handling (Admin-Panel sends ?code= only, no state)
→ state missing must NOT trigger 400, otherwise admin-panel app tiles break
- Add Middleware-Reihenfolge warning (SessionMiddleware LIFO footgun)
- Add Auth-Guard distinction: HTML-Navigation 307 vs JSON-API 401
- Add Frontend 401-handling pattern (hard navigation, not fetch redirect)
- Add stdlib-only HTTP + JWT-decode helpers (urllib.request + base64url padding)
- Add Session-Storage options table (in-memory / SessionMiddleware / Redis)
- Add CLIENT_SECRET generation guidance (admin-panel vs locally)
- Add Smoke-Test mit curl (5 calls catching 90% of typical bugs)
- Add "replace existing auth" checklist (remove old constants/routes/HTML)
- Cookie flags: explain why samesite=lax (not strict) for OIDC callback
- Logout: two separate functions, FastAPI doesn't support decorator stacking
- Hard restart guidance for middleware iteration
- Many additional Fallstricke entries from real bugs
|
2026-05-20 10:57:15 +00:00 |
|
