Skip to content

docs(django): document launch bridge endpoints feature - #510

Open
peterfarrell wants to merge 2 commits into
python-social-auth:masterfrom
peterfarrell:dev/launch-bridge-endpoints-1090
Open

peterfarrell wants to merge 2 commits into
python-social-auth:masterfrom
peterfarrell:dev/launch-bridge-endpoints-1090

Conversation

@peterfarrell

Copy link
Copy Markdown
Contributor

Add comprehensive documentation for the launch bridge endpoints feature
introduced in python-social-auth/social-app-django#1092 (#1020).

  • Explain use cases for IdP-initiated OIDC login and SPA frontend redirects
  • Document opt-in configuration via SOCIAL_AUTH_ENABLE_LAUNCH_BRIDGES
  • Detail security architectures and defense layers for idp_launch and app_launch
  • Document multi-tenant/multi-issuer and safe redirect host settings
  • Provide a guide and example template for customizing launch.html

Add comprehensive documentation for the launch bridge endpoints feature
introduced in python-social-auth/social-app-django#1092 (#1020).
@read-the-docs-community

read-the-docs-community Bot commented Sep 16, 2026

Copy link
Copy Markdown

@peterfarrell

Copy link
Copy Markdown
Contributor Author

@nijel ready for review in conjunctions with PR python-social-auth/social-app-django#1092 (#1020).

@nijel

nijel commented Sep 22, 2026

Copy link
Copy Markdown
Member

@codex review

@nijel nijel self-assigned this Sep 22, 2026

.. code-block:: python

from social_django.utils import LaunchBridge

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this really work in settings? The utils imports models and should need app registry ready. So I'd expect this to fail with `AppRegistryNotReady.


.. code-block:: python

SOCIAL_AUTH_OKTA_ALLOWED_ID_TOKEN_ISSUERS = [

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
SOCIAL_AUTH_OKTA_ALLOWED_ID_TOKEN_ISSUERS = [
SOCIAL_AUTH_OKTA_OAUTH2_ALLOWED_ID_TOKEN_ISSUERS = [

Designed for same-origin frontend or SPA redirects. Enforces 9 security layers:

1. **Opt-In Gate**: Raises ``Http404`` if ``LaunchBridge.APP`` (or
``'app_launch'``) is not present in ``SOCIAL_AUTH_ENABLE_LAUNCH_BRIDGES``.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't this also require a backend that supplies a valid HTTPS issuer?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants