Skip to content
UsherUsher

Changelog

What’s new.

Usher is in development. Here is what has landed, newest first.

  1. The site and the docs

    Docs
    • This site: the Lobby you can try, how a sign-in works, and how environments are kept apart.
    • Quickstarts for Next.js and for any OpenID Connect library, and the concepts behind them.
    • A page for reporting a Lobby that is being misused.

  2. Environments of their own

    PlatformSecurity
    • Every environment gets its own Postgres schema, its own signing keys and its own data key.
    • Secrets are sealed with AES-256-GCM, with the environment and purpose bound in as authenticated data.
    • Production handles are checked against reserved words and well-known brands, and are never reused.
    • An isolation test suite that tries to cross from one environment into another, and must fail.

  3. The Lobby

    Lobby
    • Sign in with a passkey, an emailed code, a magic link, a social account or a password.
    • Authenticator apps with backup codes, optional or required.
    • A strict, per-request Content-Security-Policy on every Lobby page.