fusionauth-issues

I work for FusionAuth. We have lambdas (basically JavaScript code that can make API calls[0] and be managed and tested[1]) that execute at fixed points in the auth lifecycle: - before a login is allowed - before a token is created - after a user returns from a federated login (SAML, OIDC, etc) - before a user registers And more[2]. And we're currently working on one for "before an MFA challenge is issued"[3]. There are some limitations[4]. We don't allow, for instance, loading of arbitrary JavaScript libraries. Not sure if that meets all your needs, but thought it was worth mentioning. 0: https://fusionauth.io/docs/extend/code/lambdas/lambda-remote... 1: https://fusionauth.io/docs/extend/code/lambdas/testing 2: full list here: https://fusionauth.io/docs/extend/code/lambdas/ 3: https://github.com/FusionAuth/fusionauth-issues/issues/2309 4:

> OAuth forces the usage of JWT. OAuth doesn't, OIDC does for the ID token[0]. OAuth, at least the inital RFCs, were released 3 years before JWT was defined. But many extensions of OAuth do require or support JWTs. Either way, I'm just not sure the demand is there. My employer has had an open issue for Pasteo[1] for years but hasn't seen much community support. Some other interesting comments here[2]. Looks like most of the implementations[3] are libraries rather than standalone auth servers. 0: https://openid.net/specs/openid-connect-core-1_0.html#IDToke... 1: https://github.com/fusionAuth/fusionauth-issues/issues/773 2: https://www.reddit.com/r/KeyCloak/comments/1e2h5w7/is_paseto... 3: https://paseto.io/

https://datatracker.ietf.org/doc/html/rfc7009 handles generic revocation without specifying implementation details. Some auth servers implement it. Keycloak does[0]. Auth0 doesn't as far as I can tell[1]. FusionAuth (my employer) has had it listed as a possible feature for years[2] but it never has had the community feedback to bubble it up to the top of our todo list. 0: https://www.keycloak.org/securing-apps/oidc-layers#_token_re... 1: https://auth0.com/docs/secure/tokens/revoke-tokens 2: https://github.com/fusionAuth/fusionauth-issues/issues/201

We went to a lot of trouble to make our magic link implementation work with anti-phishing software, corp link checkers and more. https://github.com/FusionAuth/fusionauth-issues/issues/629 documents some of the struggle. I think that a link to a page where you enter a one time code gets around a lot of these issues.