Sienna Meridian Satterwhite c3f60448ad feat: configurable OAuth scopes and cookie security via env vars ...

Add three environment variables for deployments with external identity
providers (Keycloak, Authentik, Ory Hydra, etc.):

- OAUTH_EXTRA_SCOPES: append additional scopes to the default
  "openid email profile" (e.g. "offline_access" for refresh tokens)
- OAUTH_SCOPES: full override of the requested OAuth scopes
- COOKIE_SECURE: override the Secure flag on auth cookies (useful
  for reverse proxy setups where the internal hop is HTTP)

Without these, deploying Bulwark with an external OIDC provider that
requires `offline_access` for refresh tokens is impossible — sessions
die on every page refresh because no refresh token is issued.

All three are backwards-compatible: unset = identical to current behavior.

2026-04-06 23:22:06 +02:00

..

cookie-config.ts

feat: configurable OAuth scopes and cookie security via env vars

2026-04-06 23:22:06 +02:00

discovery.ts

feat: add OAuth2/OIDC with PKCE for SSO login

2026-02-25 23:41:37 +01:00

pkce-server.ts

feat: add non-interactive SSO login flow for embedded/iframe deployments (closes #69)

2026-03-21 20:45:19 +01:00

pkce.ts

feat: add OAuth2/OIDC with PKCE for SSO login

2026-02-25 23:41:37 +01:00

token-exchange.ts

feat: add non-interactive SSO login flow for embedded/iframe deployments (closes #69)

2026-03-21 20:45:19 +01:00

tokens.ts

feat: configurable OAuth scopes and cookie security via env vars

2026-04-06 23:22:06 +02:00