configuration-authentication-cross-device

Cross-device Portal Login

Configuration and ownership

The selected published go-authcrunch supplies the parser, runtime and embedded UI. Check go.mod and the selected module directory when changing this integration; a sibling working tree is only a read-only reference. No local replacement or copied portal handler, QR generator, store or template is needed.

Inside an existing authentication portal:

authentication portal myportal {
    enable identity store localdb
    enable cross-device login
    cookie cross-device session id name __Secure-LOGIN_TRANSFER
}

Declare localdb separately and mount the portal through authenticate with myportal. Omit the cookie override to use AUTHP_CROSS_DEVICE_SESSION_ID. disable cross-device login explicitly disables the feature. Omission also disables it and preserves a nil field in adapted JSON. Enabling produces "cross_device_login":{"enabled":true} in the portal config; an explicit false/empty object is disabled on JSON load. Cookie naming alone never enables routes or a login action.

caddyfile_authn.go collects complete enable/disable statements before the ordinary miscellaneous/admin dispatch, encodes original token boundaries with cfgutil.EncodeArgs, and calls the public cross_device/parser.NewCrossDeviceLoginConfigFromDirectives once per portal. The shared parser owns grammar and duplicate/conflict checks, including imports. Reject empty/multiline tokens before encoding, nested blocks, joined quoted keywords, wrong arity and unsupported arguments without echoing their values. Individual quoted keywords preserve the same token boundaries and remain valid. Do not add per-line boolean mutation to caddyfile_authn_misc.go.

Routing and browser contract

Mount the entire namespace, without stripping its prefix:

auth.example.com {
    @portal path /auth /auth/*
    route @portal {
        authenticate with myportal
    }
}

All paths below are relative to that mount; root and nested mounts work. A name containing cross-device, such as /cross-device-team/auth, is not a transfer route by substring. /oauth2/cross-device and /saml/cross-device remain provider realms even when transfer is disabled. Unknown transfer children return 404; do not reserve the name globally or add permissive CORS.