Sake.Auth.CIMD (Sake v0.1.0)

Client ID Metadata Documents: a client identifies itself with an HTTPS URL, and the authorization server fetches the JSON document there.

The fetch is guarded: HTTPS only (unless allow_insecure), no credentials in the URL, the host must resolve to public addresses, no redirects are followed, the body is limited to 64 KB, and the whole download must finish within 5 seconds. A document may list at most 10 redirect URIs. Documents are cached for their max-age, clamped to one minute–one day; the cache holds at most 1000 documents.

Summary

Functions

fetch(config, id)

public_host?(host)

Whether the host resolves only to public unicast addresses.

url?(id)

Functions

fetch(config, id)

@spec fetch(Sake.Auth.Config.t(), term()) ::
  {:ok, Sake.Auth.Client.t()}
  | {:error, :invalid_client | :not_allowed | :unreachable | :invalid_document}

public_host?(host)

@spec public_host?(String.t()) :: boolean()

Whether the host resolves only to public unicast addresses.

url?(id)

@spec url?(term()) :: boolean()