WOWW DOCUMENTATION
Authentication & identity
Integrate email, OAuth and enterprise identity providers with secure application-side controls.
Provider options
| Method | Typical use | Key control |
|---|---|---|
| Email/password | Direct sign-in | Strong password hashing, verification and reset flow |
| Google/GitHub OAuth | Social login | Validate state, issuer, redirect URI and PKCE |
| LDAP / Active Directory | Enterprise identity | TLS, least-privilege bind account and timeouts |
Session security
- Use Secure, HttpOnly and SameSite cookies.
- Rotate session identifiers after authentication.
- Keep client secrets server-side.
- Implement account linking, logout and token revocation deliberately.
- Register exact callback URLs per environment.
WOWW core does not ship an identity provider, user database, OAuth server, LDAP connector or session store. Add an established identity library or external identity service.
Scope note: WOWW 0.2.0 is a framework package. Hosted Git collaboration, account management, Copilot plans, hosted runners, public REST/GraphQL services and a
woww/core server image are not included. The related guidance below is architecture or integration advice, not a claim that those services are live.