diff options
| author | Leitwolf11 | 2026-08-30 21:45:01 +0300 |
|---|---|---|
| committer | Leitwolf11 | 2026-08-30 21:45:01 +0300 |
| commit | 76c4c1876a86dbca0adf86750362b3581d6fc69d (patch) | |
| tree | 52bc17d6a977d6c1b13c26c1e016a0e00db99ca5 /README.md | |
| parent | c89a3f20a0f477573c41b831d993850e0adb30e7 (diff) | |
| download | progmaweb-1.0.0.tar.gz | |
Add secure Google sign-in to Progmasoft Account. Use the server-side authorization-code flow with an exact account-domain callback, temporary hardened external cookies, verified provider email matching, canonical Account-name creation for new users, and no separate ViGet publisher identity. Add frontend entry points, provider failure guidance, locked Google authentication dependencies, service secret injection, and backend regression coverage without committing OAuth credentials.1.0.0
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 6 |
1 files changed, 6 insertions, 0 deletions
@@ -59,6 +59,12 @@ The frontend defaults to `http://localhost:5085` for server-side API requests. S uses another origin. Browser requests use the same-origin `/api` boundary so production can proxy them without exposing an internal address. +Google sign-in uses a server-side authorization-code flow. Configure `Authentication__Google__ClientId` and +`Authentication__Google__ClientSecret` only in the process environment or secret manager. The production OAuth client +uses `https://account.progmasoft.com` as its JavaScript origin and +`https://account.progmasoft.com/api/v1/accounts/oauth/google/callback` as its exact redirect URI. Never commit the +downloaded Google client JSON. + ## Verification ```text |