Leo Vasanko
f9f4d59c6b
Deny creating sessions for hosts other than rp-id subdomains.
2025-10-04 17:26:03 -06:00
Leo Vasanko
bfb11cc20f
A major refactoring for more consistent and stricter flows.
...
- Force using the dedicated authentication site configured via auth-host
- Stricter host validation
- Using the restricted app consistently for all access control (instead of the old loginview).
2025-10-04 15:55:43 -06:00
Leo Vasanko
591ea626bf
Add host-based authentication, UTC timestamps, session management, and secure cookies; fix styling issues; refactor to remove module; update database schema for sessions and reset tokens.
2025-10-03 18:31:54 -06:00
Leo Vasanko
dcca3e3fbd
Globals restructured to their own module. Origin and RP definition.
2025-08-06 13:23:35 -06:00
Leo Vasanko
cf138d90c5
Checkpoint, fixing reset token handling broken in earlier edits.
2025-08-06 09:55:14 -06:00
Leo Vasanko
7f8f77ae1e
Separated session management from its FastAPI-dependent parts, creating authsession.py on main level.
...
Startup/main/scripts cleanup, now runs with passkey-auth command that takes CLI arguments.
2025-08-05 09:02:49 -06:00
Leo Vasanko