Package options reference

This reference lists package-wide options for network requests, logging, and validation. Set options near the top of app.R, before creating the provider and client. The defaults apply when an option is unset.

For example, allow a slow provider up to ten seconds per HTTP request:

options(shinyOAuth.timeout = 10)

Times are in seconds unless a setting explicitly says milliseconds. Options affect the R process; use oauth_client() and oauth_module_server() arguments for settings that belong to one client or module. See Usage for app setup.

check_oauth21() is an opt-in, read-only assessment pinned to OAuth 2.1 draft 16. Ruleset 1.1.0 reports requirement sources: OAuth core, OIDC, extensions, security guidance, and package or application policy. Recommendations do not change the mandatory configuration verdict. Existing OAuth 2.0 authentication methods and callback choices remain available. For example, Basic/body client authentication can pass while receiving advice to consider asymmetric methods. Distinct callback routes remain valid when issuer identification is unavailable, and localhost callbacks remain supported with advice to prefer a loopback IP.

Callback capacity advice uses local field defaults and an 8000-byte minimum envelope as package thresholds, not numeric OAuth 2.1 requirements. Test the complete encoded query or form body against package, proxy and browser limits: include parameter names, separators, fixed application parameters, percent encoding, state, issuer and JARM. An aggregate floor cannot guarantee that all decoded fields fit simultaneously. Back-channel redirect blocking is package policy motivated by credential confidentiality; the draft’s browser redirect rules are a separate requirement.

Logging

See the audit logging vignette for details about audit hooks, and the OpenTelemetry vignette for more details about logs and traces via OpenTelemetry.

Validation and URL policy

Note on allowed_hosts: patterns support globs (*, ?). Using a catch‑all like "*" matches any host and effectively disables endpoint host restrictions (scheme rules still apply). Avoid this unless you truly intend to accept any host; prefer pinning to your domain(s), e.g., c(".example.com").

Advanced parameter overrides

By default, ‘shinyOAuth’ blocks certain security-critical parameters from being passed via extra_auth_params, extra_token_params, and extra_token_headers. This helps prevent accidental misconfiguration that could break state binding, PKCE, or client authentication.

Set the callback format with oauth_client(response_mode = ...).

If you have a specific, advanced use case where you need to override one of these blocked parameters, you can unblock them using the following options:

Async timeout (mirai)

Async condition replay

Token lifetime fallback

HTTP settings (timeout, retries, user agent)

State store

Size caps

State envelope

These prevent maliciously large state parameters from causing excessive CPU or memory usage during decoding and decryption.

Callback query

These limits reject oversized callback URLs and POST bodies before they cause excessive processing or logging. Keep the defaults unless a legitimate provider response needs more space.

Generated login state must fit both shinyOAuth.callback_max_state_bytes and the state envelope limits above. Their outer-token defaults both allow 8192 bytes (base64url state is ASCII). Lowering either limit can restrict ordinary logins with many scopes or other state metadata. prepare_call() checks both budgets before storing pending login state, publishing a Request Object, or sending PAR. Increasing only one limit does not override the other.

Local debugging

Don’t enable these options in production. They disable key security checks or alter error behavior, and are intended for local testing/debugging only.