Linus Rath
b7f53a3a8b
fix: bind a purpose into encrypted payloads (GHSA-cqqx-mjcf-mh55)
2026-09-17 20:16:51 +02:00
Linus Rath
e908aee994
fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)
2026-09-17 20:01:35 +02:00
Linus Rath
af234f64a4
fix: drop max_age=0 from OIDC re-authentication requests #938
2026-09-07 22:34:47 +02:00
Loïs Postula
638fc7db4e
feat(oauth): add OAUTH_AUTHORIZE_URL to override authorize endpoint
...
Lets a per-brand authorize host front a single canonical issuer, so the
IdP token's `iss` stays constant for downstream validation while login
branding varies per domain. Discovery, token exchange and refresh keep
using OAUTH_ISSUER_URL.
2026-06-19 12:30:23 +02:00
Linus Rath
964136b540
feat: require re-authentication for device pairing and SSO
2026-06-05 19:23:06 +02:00
Linus Rath
63f2169ae7
fix: add OAUTH_ALLOW_PRIVATE_ENDPOINTS for split-DNS setups
2026-05-22 17:22:14 +02:00
Linus Rath
fc5f6f43d6
feat: expose PWA, app identity, and extension directory keys in JSON config #312
2026-05-21 23:35:58 +02:00
Linus Rath
97ddf935a8
fix: mobile handoff flow for OAuth authentication
2026-05-19 00:45:35 +02:00
Linus Rath
ecd0467ffa
fix: stop pulling node:dns into client bundle via OAuth discovery
2026-05-18 19:31:38 +02:00
Linus Rath
f39366b470
fix: read OAUTH_SCOPES at runtime instead of build time
2026-05-15 20:37:00 +02:00
Linus Rath
51745ea03d
feat: web setup wizard + admin config/state dir split ( #226 )
2026-05-09 17:37:41 +02:00
Linus Rath
d3d79be64c
feat: multi-server JMAP support
2026-05-06 17:33:55 +02:00
Pascal Dietrich
f9052eb23f
feat: add SESSION_SECRET_FILE and OAUTH_CLIENT_SECRET_FILE env vars
2026-04-09 22:13:08 +02:00
Linus Rath
83a0a1e235
feat: add non-interactive SSO login flow for embedded/iframe deployments ( closes #69 )
2026-03-21 20:45:19 +01:00
Linus Rath
Linus Rath
Loïs Postula
Pascal Dietrich