OAuth/OIDC Security

Baseline requirements

• PKCE required for public clients.
• Redirect URIs must match exactly.
• Authorization Code flow only.
• Do not use Implicit flow.

Redirect URI policy

• No wildcard redirect URIs.
• No dynamic redirect hostnames.
• Register separate clients for sandbox/staging/production.

Token validation rules

Validate at minimum:

• iss equals the exact discovery issuer.
• aud contains expected client ID.
• exp is in the future.
• nbf is in the past (bounded clock skew).
• nonce matches original auth request for browser flows.

If you use a branded auth domain, validate against the branded issuer returned by discovery instead of hard-coding id.uselamba.com.

JWKS handling

• Cache signing keys by kid.
• Refresh JWKS on unknown kid.
• Retry validation once after refresh.
• Fail closed if signature still fails.

Session hardening checklist

• Keep cookies httpOnly, secure, sameSite=lax.
• Rotate refresh tokens and treat them as one-time credentials when possible.
• Revoke session credentials on membership/policy changes.
• Separate sandbox and production sessions.

Operational checks

• Monitor token exchange failures (invalid_grant, invalid_client).
• Log traceId and resolved workspace/project context for auth failures.
• Run integration smoke tests for login + refresh before release.