mirror of
https://github.com/root-fr/jmap-webmail.git
synced 2026-09-23 16:01:15 +00:00
Basic Auth sessions now persist across page refreshes via an encrypted httpOnly cookie (AES-256-GCM). The feature is opt-in: admin sets SESSION_SECRET env var, user checks "Remember me" at login. Rework the 2FA input from a checkbox+animated panel to a discreet "I have a 2FA code" text link that reveals the TOTP field on click.