spec: Specify select account flow with custom ui#5788
Open
tung2744 wants to merge 6 commits into
Open
Conversation
tung2744
commented
Jun 24, 2026
…tinuation Custom UI hosted same-site with Authgear (shared registrable domain) lets SameSite=Lax cookies flow on a POST form submit, not just a GET navigation. Cross-site Custom UI simply doesn't get this feature and falls back to the normal authentication flow.
Contributor
Author
|
Updated the spec with the assumption of same-site custom ui. |
carmenlau
reviewed
Jul 9, 2026
…dentify option Supersede the out-of-band x_select_account_token + redirect design with a new identification option, select_account, inside the identify step of the login and signup_login flows. This reuses the existing Authentication Flow API and CORS/session infrastructure instead of introducing a new token store and endpoints, and documents config, HTTP API shapes, CORS behavior, security analysis, and use cases for the new approach. Also cross-reference the new spec from the identification: select_account section of the Authentication Flow API reference.
Contributor
Author
|
Redesigned using authflow api with assumption on same site custom ui.
|
…arams signup/reauth/account_recovery are design scope boundaries, not edge cases within a supported flow, so they move to a new Scope section. Also document max_age, id_token_hint, prompt=select_account, and acr_values against the actual authorize-endpoint behavior, and fix an existing inconsistency where login_hint was said to omit the option "regardless of match" though only a mismatch does.
tung2744
commented
Jul 21, 2026
|
|
||
| - **`prompt=login`**: option omitted (see [Session and account resolution](#session-and-account-resolution)). | ||
| - **`prompt=none`**: not applicable — decided before any flow exists. | ||
| - **`prompt=select_account`**: not supported — has no effect, despite sharing its name with this feature's `select_account` identification option (unrelated concepts). |
Contributor
Author
There was a problem hiding this comment.
Research on prompt=select_account behavior
tung2744
commented
Jul 21, 2026
| - **`max_age`**: not a separate rule. An expired `max_age` is folded server-side into a synthesized `prompt=login`, so it's already covered by the `prompt=login` case above. | ||
| - **`id_token_hint`**: option omitted when its `sub` claim identifies a different user than the session — the same rule as a mismatched `login_hint` (see [Session and account resolution](#session-and-account-resolution)). | ||
| - **`acr_values`**: not supported — no interaction with `select_account` today. | ||
| - **`login_hint` matching the session's user**: option is still offered — only a *mismatched* `login_hint` omits it. |
Contributor
Author
There was a problem hiding this comment.
Check existing login_hint behavior on api / default auth ui
Compares how Google, Azure AD, Auth0, and Keycloak actually handle prompt=select_account, login_hint, and id_token_hint at their authorize endpoints, based on live testing and reading Keycloak's source.
Contributor
Author
|
Added a section on research of well known idp's behavior on prompt=select_account.
So my take:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ref DEV-3670