friloo
8766927123
Certificate (RFC 7523 client assertion) as an alternative to the client secret: one-click generation of a 3072-bit RSA key pair with a self-signed certificate, .cer download (public part only), own PEM upload with validation, expiry display, encrypted key storage. Both the authorization code exchange and the Graph client-credentials request use the selected method. Step-by-step guides for secret, certificate and the app registration are shown in the settings. Security audit (docs/security-audit.md) and fixes: - Multi-tenant mode ignored the unverified email claim: matching now uses the UPN only, or the email claim when xms_edov is true. - Login starts are rate limited per client (30 per 10 minutes). - Optional trusted proxy header for client IPs (M365_LOGIN_CLIENT_IP_HEADER / filter). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JJxAHYdMfKPoN4koRc4Ci2 |
||
|---|---|---|
| .. | ||
| class-m365-login-admin.php | ||
| class-m365-login-auth.php | ||
| class-m365-login-button.php | ||
| class-m365-login-certificate.php | ||
| class-m365-login-crypto.php | ||
| class-m365-login-graph.php | ||
| class-m365-login-jwt.php | ||
| class-m365-login-settings.php | ||
| class-m365-login.php | ||
| functions.php | ||