Skip to content

docs: point the RFC 9700 matrix at v0.19.2 and record the state binding - #131

Merged
Bccorb merged 1 commit into
mainfrom
docs/rfc9700-v0.19.2
Oct 21, 2026
Merged

Bccorb merged 1 commit into
mainfrom
docs/rfc9700-v0.19.2

Conversation

@Bccorb

@Bccorb Bccorb commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Follow-up to #129 now that API 0.19.2 is released.

  • The CSRF row (RFC 9700 sections 2.1 and 4.7) moves from Gap to "Meets, configurable": the state is bound to the client that started the sign-in from 0.19.2 (fix(oauth): bind the OAuth state to the client that started sign-in seamless-auth-api#463), with the OAUTH_ALLOW_UNBOUND_STATE escape hatch named.
  • Every code link moves from v0.19.1 to v0.19.2 (and types v0.28.0 to v0.29.0), with line anchors re-checked against the tag.
  • The caution note becomes an upgrade note: API 0.19.2 needs @seamless-auth/client 0.7.1 or later.
  • The security posture page OAuth row says the state is bound from 0.19.2.

Checks: npm run lint clean, npm run build 56 pages.

The OAuth state is bound to the client that started the sign-in from 0.19.2 (#463), so the
CSRF row moves from a gap to met, and every code link moves to the v0.19.2 tag.
@Bccorb
Bccorb merged commit 555ae37 into main Oct 21, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant