Security

Security behaviour

Origin checks: state-changing requests from untrusted origins are rejected, and callback URLs must match a trusted origin. OAuth redirect URIs must match exactly. See Origins and redirect URLs.
Cross-site sign-in: sign-in started by a cross-site navigation is blocked.
Session cookie: sessions use an HTTP-only cookie, named __Secure-legation.session_token over HTTPS. See Sessions and cookies.
Fresh sessions: sensitive account changes need a recent sign-in.
Two-factor limits: failed second-factor attempts are capped.
No secrets in the client: the client package contains only client code. Never put server credentials in your front end.