| Age | Commit message (Collapse) | Author | |
|---|---|---|---|
| 2026-07-25 | Extract flashes to i18n and stop dispatching on submit labels | erdgeist | |
| 2026-07-24 | Give all sessions a uniform absolute lifetime of one week | erdgeist | |
| Enforced at restore via a login-time stamp, written only at genuine logins so the limit stays absolute rather than sliding. The cookie name rotation logs everyone out once at deploy. Second-factor users are deliberately not treated worse than password-only ones. | |||
| 2026-07-24 | Complete the login only after the second factor | erdgeist | |
| Enrolled users get a pending marker instead of a session after the password step; a valid code through the challenge writes the real session via reset_session. otp_required without enrollment funnels into setup everywhere except the enrollment, user, and login machinery. | |||
 |
index : cccms | |
| [no description] | User & |
| summaryrefslogtreecommitdiff |