docs: replace unsafe IdP request params example

[desimone]

Summary

The Identity Provider Request Params reference demonstrates client_id, response_type, and redirect_uri with literal placeholder values and repeats them in a Console screenshot. Those values are not inert examples: request params are appended to the authorization request, so saving client_id=client_id can replace the configured OAuth client and lock administrators out of the Console login flow.

Replace the example with the valid custom parameter prompt: login and state that Pomerium-generated OAuth parameters cannot be overridden. Remove the screenshot because it only duplicates the field layout while presenting unsafe values as valid configuration.

This documents the runtime protection in pomerium/pomerium#6522. The identical release-branch patch was validated in pomerium/pomerium#6523, which was closed so the normal post-merge backport automation can preserve merge order. This change does not attempt to catalog provider-specific optional parameters.

Related

• Core fix: identity: prevent IdP request params from overriding OAuth flow pomerium#6522
• Core 0.33 validation PR: [0.33] identity: prevent IdP request param overrides pomerium#6523 (closed in favor of post-merge backport automation)
• ENG-4222

Testing

• yarn run check
• yarn build

AI disclosure

GPT-5 Codex drafted the documentation correction from the maintainer-supplied reproduction and implementation scope; the maintainer required removal of the misleading example across the Core and 0.33 release work.

Checklist

• reference any related issues
• updated docs
• updated UPGRADING.md (not applicable; no upgrade procedure changed)
• updated CHANGELOG.md (not applicable; reference correction only)
• disclosed AI usage (or wrote "none") per AI_POLICY.md

[netlify]

✅ Deploy Preview for pomerium-docs ready!

Name	Link
🔨 Latest commit	73b90f3
🔍 Latest deploy log	https://app.netlify.com/projects/pomerium-docs/deploys/6a5669f413a16e0008d76935
😎 Deploy Preview	https://deploy-preview-2312--pomerium-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[greptile-apps]

Greptile Summary

This PR corrects the Identity Provider Request Params reference. The main changes are:

• Replaces unsafe OAuth placeholder params with prompt: login.
• Adds a note that generated OAuth params cannot be overridden.
• Removes the Console screenshot that repeated the unsafe values.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
content/docs/reference/identity-provider-settings.mdx	Updates the IdP request params examples and explanatory text, and removes the screenshot reference.
content/docs/reference/img/idp_options/idp-request-params.png	Deletes the outdated screenshot asset with no remaining references.

_{Reviews (1): Last reviewed commit: "docs: fix IdP request params example" | Re-trigger Greptile}