Bhauu AuthDocumentation
Browse documentation

Security

Security guide

Keep the OAuth transaction and your application session secure end to end.

Protect the OAuth transaction

  • Use a fresh high-entropy PKCE verifier with S256 on every authorization attempt.
  • Generate and validate random state; consume the transaction once.
  • Register exact redirect URIs and use HTTPS in production.
  • Protect the callback from open redirects and do not log codes or verifiers.

Protect credentials and sessions

  • Keep any registered confidential-client secret on the server, never in SPA code, public HTML, mobile binaries, or a repository.
  • Do not use long-term browser storage as a default token vault.
  • For application-owned sessions, use HttpOnly, Secure, SameSite cookies where suitable and implement CSRF protection.
  • Expire and revalidate local sessions. React to Bhauu-side revocation; do not assume instant remote logout.
  • Rotate server-held credentials promptly if compromised.

Review PKCE generation and session boundaries before going live.