feat: Private JWT CA support for passwordless - #158
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| "client_secret": client._client_secret, | ||
| "connection": options.connection, | ||
| } | ||
| client._apply_client_authentication(body, f"https://{origin_domain}/", in_body=True) |
There was a problem hiding this comment.
Both this call and the one in verify() go through _apply_client_authentication unconditionally, so a client with no secret and no signing key now hits the ConfigurationError the helper raises. Passkey signin guards the same call with a check for a configured secret or key first, because it allows public clients. Before this change, start sent client_secret as None and still reached Auth0.
If passwordless is meant to always require a confidential client, this is the right behavior and worth a line in the docstring saying so. If public clients should still work here, shall we wrap the call the way passkey does? Either way it reads better as a deliberate choice than as a side effect of the helper.
There was a problem hiding this comment.
Auth0 docs mention that client secret is mandatory for RWA - https://auth0.com/docs/api/authentication/passwordless/authenticate-user#param-client-secret
Should we still add docstrings?
…-server-python into feat/passwordless-support-ca # Conflicts: # src/auth0_server_python/error/__init__.py
3 participants
Changed
PasswordlessClient.start()PasswordlessClient.verify()resolved domain.
Testing
Tested via usual Passwordless flow as described in #153