ApiCore

0 Fork 0

T

Nick SzaunigandClaude Opus 5.5 2de93bc087 fix(auth): atomic refresh rotation and a 7-day absolute session limit

- Rotation claims the old token with a conditional update; of two
  concurrent refreshes only one gets a successor, so a stolen token cannot
  fork into two live sessions.
- A token rotated out less than 10 s ago (parallel tab) is refused without
  revoking every session; later reuse still revokes them all.
- Sessions end at most SESSION_MAX_AGE (default 7 days) after login: the
  login time is inherited by every rotated token and caps its expiry.
- The refresh cookie is cleared with the same attributes it was set with.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

2026-10-01 02:30:32 +02:00

.gitea/workflows

Env Update

2026-08-27 08:32:47 +02:00

ApiCore-Backend

fix(auth): atomic refresh rotation and a 7-day absolute session limit

2026-10-01 02:30:32 +02:00

ApiCore-Frontend

fix(auth): lock accounts after failed attempts, one-time TOTP codes, stronger MFA changes

2026-10-01 02:27:47 +02:00

deploy/k8s

fix(backup): seal backups and require step-up auth to restore