Security and environments

Development, staging, and production use distinct clients and redirect registrations. Treat every environment as a separate security boundary.

• Never use production secrets in local development.
• Never accept a callback issued for another environment.
• Keep issuer, client ID, secret, and redirects in one typed environment configuration.
• Fail startup when required OAuth configuration is missing.

• Perform code exchange, refresh, introspection, revocation, and UserInfo calls on the server.
• Encrypt secrets and refresh tokens at rest.
• Redact authorization codes, tokens, secrets, cookies, and personal claims from logs.
• Do not place tokens in URLs.
• Rotate a secret immediately if it may have been exposed.

• Generate new state, nonce, and PKCE values for each attempt.
• Make OAuth transactions short-lived and single-use.
• Regenerate the local session identifier after authentication.
• Use secure, HTTP-only cookies and protect state-changing requests against CSRF.
• Authorize protected resources on every server request, not only in the interface.

Request and retain only the data required for the website's documented purpose. Define retention, deletion, access, and incident processes with your privacy and security owners.