Issues

• widget-token (1.4.0): subject token not bound to the session user; revoked token yields 400 not 401

  bugP2small
  FortiumPartners/identity-client#18 · Filter by author bautrey opened on Sep 29, 2026
  2

• sanitizeReturnTo: apply the printable-ASCII rule to the decoded form too (defense-in-depth; not exploitable via the fastify plugin)

  bugP1small
  FortiumPartners/identity-client#14 · Filter by author bautrey opened on Sep 2, 2026

• No CI: nothing runs npm test or npm run build on pull requests

  enhancementP1small
  FortiumPartners/identity-client#13 · Filter by author bautrey opened on Sep 2, 2026
  1

• packages/admin/dist is stale relative to src — npm run build regenerates 16 files that were never committed

  bugP1small
  FortiumPartners/identity-client#12 · Filter by author bautrey opened on Sep 2, 2026
  1

• [P0] ALLOWED_PROMPTS advertises select_account, which Identity rejects — any app trusting it ships a total login outage

  bugP1small
  FortiumPartners/identity-client#9 · Filter by author bautrey opened on Aug 4, 2026

• Add Cache-Control: no-store to /auth/widget-token response (RFC 6749 §5.1)

  bugP2
  FortiumPartners/identity-client#7 · Filter by author bautrey opened on May 12, 2026

• Add CI workflow: typecheck + tests on PR

  enhancementP2
  FortiumPartners/identity-client#6 · Filter by author bautrey opened on May 12, 2026

• [feature] Export reusable test-login plugin from @fortium/identity-client

  featurefortium-ideasP2
  FortiumPartners/identity-client#4 · Filter by author bautrey opened on Apr 5, 2026