Linus Rath
defe4e93f3
fix: bind the sign-in time to the refresh token and count unstamped sessions from a fixed time
2026-10-28 03:42:19 +01:00
Linus Rath
6e5d8faec6
feat: refuse to restore or renew sessions older than the admin-set maximum length
2026-10-28 02:30:32 +01:00
Linus Rath
42117da498
fix: stop replaying a stored credential the mail server refused, so a stale session cannot get the webmail banned (GHSA-g6c7-r7wq-xrm2)
2026-10-26 15:00:56 +01:00
Linus Rath
89ef4d14f2
fix: budget failed sign-ins per client and forward the client address to the mail server
2026-10-19 00:43:00 +02:00
Linus Rath
3f01e94319
fix: key synced settings on the account a bearer token belongs to
...
A Bearer login may claim a bare local part, which is accepted when the
server's `Session.username` has the same local part (TOTP users who
type `john` log in this way). Settings were keyed on that claim, so on a
multi-domain server `john@b.example ` could claim `john` and read and
overwrite the synced settings of the `john@a.example ` who signs in as
`john` with a password.
`resolveJmapIdentity` now returns the canonical account name for a bare
Bearer claim, the context cookie carries it as `accountName`, and the
settings route keys on it. Basic logins and fully-qualified claims keep
their existing key.
2026-09-26 14:59:55 +02:00
Linus Rath
691cde6468
fix: explain why calendar subscriptions fail with not authenticated #1073
2026-09-23 18:31:27 +02:00
Linus Rath
e055ee8201
fix: verify credentials upstream before minting identity cookies (GHSA-wxcm-j4jc-9fxq)
2026-09-17 20:48:42 +02:00
Linus Rath
e908aee994
fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)
2026-09-17 20:01:35 +02:00
Linus Rath
f275fbe2e4
fix: bind stalwart auth context to credential, not cookie-claimed username
2026-05-18 13:00:40 +02:00
Linus Rath
c646c87030
fix: standardize punctuation in tooltips and comments across multiple locales and code files
2026-05-14 21:44:24 +02:00
Linus Rath
2d7e24b513
perf: parallelize login round-trips and drop redundant JMAP re-verify
2026-05-11 11:04:13 +02:00
Linus Rath
5f464d4ee2
feat: lift 5-account cap on HTTP/2
2026-05-07 12:28:33 +02:00
Linus Rath
d3d79be64c
feat: multi-server JMAP support
2026-05-06 17:33:55 +02:00
Linus Rath
45a4db1c22
fix: pin JMAP auth verification to configured server URL #237
2026-04-30 15:34:14 +02:00
Linus Rath
dafc8ace3c
feat: track unique logins
2026-04-28 08:19:46 +02:00
Linus Rath
aa40c8be26
fix: harden proxy auth and SSRF defenses
2026-03-31 17:47:09 +02:00
Linus Rath
Linus Rath