15 documents tagués avec "best-practice"

LuxID checks passwords against breach intelligence at registration and reset, blocking compromised credentials before they reach your users' accounts.

Operational guidance for integrating with LuxID: timeouts, retries and backoff, idempotency, JWKS caching, and how to behave during a LuxID outage.

Viewing and rotating Client Secrets, and SAML signing certificate lifecycle in the LuxID Console.

A self-test checklist for LuxID Partners: what to verify in your own OIDC/OAuth 2.0 integration, and what LuxID enforces for you.

How LuxID signs ID Tokens, how to validate signatures using the JWKS endpoint, key rotation behaviour, and client credential security.

How to connect LuxID to your application: link users on the stable sub claim, keep your own internal user ID, and treat the IdP as a pluggable component.

WebAuthn/FIDO2 passkeys on LuxID: device binding, platform and roaming authenticators, token claims, fallback behaviour, and phishing resistance.

Architectural decisions to make before writing production code: protocol, required auth_level, MFA, Sphere, session strategy, logout, and branding.

Security checklist for LuxID integrations: HTTPS, PKCE, state/nonce, ID Token validation, token storage, open redirects, and anti-patterns to avoid.

Rules, configuration steps, and troubleshooting guidance for redirect URIs and domain ownership in LuxID Applications.

Security guidance for LuxID integrations: application protection, session lifecycle, key management, and advanced options such as PAR and JAR.

How LuxID Partners stay informed about platform security notices, keep OIDC and JWT libraries patched, and stay ready for JWKS key rotation.

LuxID evaluates each sign-in against contextual security signals and surfaces a qualitative risk indicator as an ID Token claim for Partner use.

How to persist refresh tokens, silently renew sessions, and avoid re-prompting users for credentials and OTP on every app restart.

LuxID's hosted login page: redirect-based authentication, branding boundaries, session reuse, and why Partners should never build their own login form.