Post

openauth beta is here you're gonna wanna watch this video more info in thread www.youtube.com/watch?v=mKKx...

🎉🎉 congratulations. I miss this kind of service from other ecosystems, so looking forward to trying this out

Is defaulting allow to use `x-forwarded-host` a safe default? That would allow any application to retrieve an access token from the server, right?

this is a very good point - this is why i knew i had to slap a beta flag on it for at least a month i really wanted to have a default `allow` function implementation so people don't have to specify it but idk if a good default is possible

i guess what i can do is not use x-forwarded-host and in the sst component pass in `OPENAUTH_HOST` which is the domain we expect this to live it and it can check against that

You could probably allow all with a giant scary console.warn 😅