We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
Sync the Home and Roadmap status notes with the reworked README
Gate the legacy-link migration note behind AllowExistingAccountLink Mirrors the #354 fix into the wiki: the Security Model page gains an upgrade note (the legacy username-keyed migration now honors the AllowExistingAccountLink opt-in, with break-glass and the takeover-window caveat), and the 9p4 migration page's now-false 'migrates automatically, no admin action' line is corrected to point at the flag and the runbook.
Bring the migration status up to date through #353
Sync the Home and Roadmap status with the semi-halted README notice
Add the Architecture page and link it from Home
Document the auth-page CSP and the rate-limiter keying/notice; drop the stale pre-alpha label The Security Model page did not mention the nonce-based Content-Security-Policy the auth page has carried since the response-hardening work, even though the Login Flow page already points at the Response hardening section for it. Describe the policy and what it denies. The rate-limiting section now also covers two behaviors that landed after the last wiki pass: IPv4-in-IPv6 transition sources (NAT64 well-known prefix, 6to4, IPv4-compatible) are keyed on their embedded IPv4 rather than the shared /64, and throttling engagement is summarized in a bounded log notice (one line per minute, count only) so an operator can spot sustained abuse or a pooled-proxy misconfiguration. The migration page still called the project pre-alpha; the maturity ladder names this stage In-Development, so align the warning with the Roadmap wording.
Add a Login Flow page describing both sign-in flows end to end Walk an OpenID Connect and a SAML 2.0 sign-in through the four shared stages (challenge, identity provider, callback validation, session mint), each with a sequence sketch, and cover role mapping, canonical-link account resolution, self-service linking, edge rate limiting, and Quick Connect for non-web clients. Cross-link each validation step to the Security Model rather than restating it, and add the page to the Home Pages list.
Add a Roadmap page with the maturity ladder; sync the Home status to In-Development
Document the PKCE downgrade check, SAML size cap, and state-store bound
Document the hardening merged since the last wiki pass Security Model: RFC 9207 authorization-response issuer check (with the DoNotValidateResponseIssuer escape hatch), the avatar raster content-type allow-list (SVG refused), replay-cache enforcement on the account-linking callback, and SSO revocation via POST /sso/Unregister. Troubleshooting: the 'SSO response validation failed' cause and its per-provider relax.
Security Model: document optional rate limiting and write-only client secret
Add 'Migrating from 9p4' wiki page Document the switch from the archived 9p4/jellyfin-plugin-sso: same plugin GUID, so it is an in-place upgrade that preserves the config; the pre-alpha/test-only caveat; the fail-closed behavior changes an upgrader must check (OIDC asymmetric-signing + sub keying, SAML SHA-1/ DTD/time/audience); and the rollback path. Linked from Home. Refs iderex/jellyfin-plugin-sso#150
Document the OpenID id_token validation The Security Model page now describes the fail-closed id_token checks (JWKS signature under an asymmetric-only allowlist, issuer, audience/azp, lifetime, at_hash), and Troubleshooting gains the matching failure entry (HS256-signed tokens, clock drift, issuer mismatch, missing JWKS). Refs iderex/jellyfin-plugin-sso#134
Reflect yesterday's SAML/OIDC hardening in the security docs Security-Model gained the DTD/XXE-billion-laughs prohibition (PR #121), the OpenID state provider-binding and single-use replay guard (PR #56), the defensive response headers on the rendered auth page (PR #124), and the structured audit trail (PR #132) - none were reflected here yet. Troubleshooting's OpenID state lifetime was stale: it said about a minute, but PR #56 raised it to 15 minutes to accommodate provider-side MFA/consent.
Add the pre-alpha production-use warning to the wiki Home page Mirrors the README warning: pre-alpha, developer testing only, not to be installed on a production system. Refs iderex/jellyfin-plugin-sso#179
Merge initial wiki state
Initial wiki: Home, Installation, Security Model, Troubleshooting
Initial Home page