access-on-cf is defense in depth for applications already placed behind a Cloudflare Access application. It does not create the Access application or replace the edge policy.

The verifier:

• reads only Cf-Access-Jwt-Assertion;
• accepts only RS256 signatures;
• obtains public keys from the configured HTTPS team origin;
• validates issuer, application audience, issue time, not-before time, and expiry;
• rejects ambiguous or unsupported identity shapes;
• returns generic HTTP errors that do not expose token or key details.

Applications must still authorize operations on their own domain resources after authentication.

• Never log or persist the assertion token.
• Use the Access subject as the stable human identifier; do not key ownership by email.
• Use a separate Access application audience for each service.
• Never enable the local resolver in a deployed environment. It enforces dev plus a loopback URL, but production configuration should also omit all AUTH_DEV_* values.
• Pin releases or commits when consuming this repository from GitHub.

Do not open a public issue for a suspected vulnerability. Report it privately to the Auditmos organization maintainers with the affected version, reproduction steps, and impact. Do not include live Access tokens, private keys, or organization configuration in the report.