Max Isbey 6faabbe244 Apply the request body limit to the OAuth authorization server endpoints ...

create_auth_routes now wraps its endpoints in RequestBodyLimitMiddleware,
so /token, /revoke, /register and POST /authorize answer 413 to bodies
over the 4 MiB default before any form or JSON parsing. The limit sits
inside the CORS wrapper so browser clients still get CORS headers on the
413; GET and OPTIONS requests pass through untouched.

2026-08-19 15:30:44 +00:00

..

middleware

Require integrity protection for MRTR requestState (#3032)

2026-06-30 21:30:32 +01:00

__init__.py

tests: add missing init files (#1831)

2026-01-06 19:52:09 +01:00

test_error_handling.py

Apply the request body limit to the OAuth authorization server endpoints

2026-08-19 15:30:44 +00:00

test_identity_assertion.py

Replace httpx and httpx-sse with httpx2 (#2972)

2026-07-14 17:05:08 +01:00

test_protected_resource.py

Replace httpx and httpx-sse with httpx2 (#2972)

2026-07-14 17:05:08 +01:00

test_provider.py

Require integrity protection for MRTR requestState (#3032)

2026-06-30 21:30:32 +01:00

test_routes.py

Preserve empty issuer/resource paths on AuthSettings (#2987)

2026-06-26 11:41:41 +02:00