Dan Milne 2d5650e620 Bind forward-auth fa_token to its destination host ...

An observed fa_token (via Referer leaks, access logs, JS monitors)
could previously be redeemed against a different reverse-proxied app
within the 60s TTL. The token now stores the destination host at
creation and the verifier rejects mismatches without burning the cache
entry, so legitimate destinations can still redeem.

Co-Authored-By: Claude Opus 4 <noreply@anthropic.com>

2026-04-20 19:04:53 +10:00

..

assets

Harden OIDC, add SVG sanitization, improve form UX and security defaults

2026-04-06 21:06:51 +10:00

channels/application_cable

Add files to support brakeman and standardrb. Fix some SRB warnings

2026-01-01 13:18:30 +11:00

controllers

Bind forward-auth fa_token to its destination host

2026-04-20 19:04:53 +10:00

helpers

Add dark mode with toggle and localStorage persistence

2026-03-22 00:37:58 +11:00

javascript

Add remember me checkbox, center and narrow sign-in form

2026-04-11 11:22:51 +10:00

jobs

StandardRB fixes

2026-01-01 13:29:44 +11:00

lib

Add missing files, fix formatting

2026-01-05 23:34:11 +11:00

mailers

Hold TOTP enrollment secret server-side and email user on activation

2026-04-20 18:17:50 +10:00

models

Revoke full token chain on OIDC authorization-code replay

2026-04-20 17:39:08 +10:00

services

Harden OIDC, add SVG sanitization, improve form UX and security defaults

2026-04-06 21:06:51 +10:00

views

Hold TOTP enrollment secret server-side and email user on activation

2026-04-20 18:17:50 +10:00