mirror of
https://github.com/actualbudget/actual.git
synced 2026-05-06 15:12:35 -05:00
Auto-detect the ID-token signing algorithm from the IdP's discovery metadata, with an optional ACTUAL_OPENID_ID_TOKEN_SIGNED_RESPONSE_ALG override. RS256 is still preferred when advertised, so existing installs are unaffected; IdPs that sign with ECDSA (ES256/ES384/ES512) or other RSA variants now work. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>