Linus Rath 034ee27057 fix: keep the setup token out of access logs, referers and history ...

The startup banner printed `/setup?token=...`, so the one-hour bootstrap
token that grants the setup wizard landed in reverse-proxy access logs,
Referer headers and browser history. The link now carries the token in
the fragment, which never leaves the browser, and the wizard removes it
from the address bar as soon as it reads it. Old `?token=` links still
work and are cleaned up the same way.

2026-09-26 16:32:38 +02:00

..

session.ts

feat: expose PWA, app identity, and extension directory keys in JSON config #312

2026-05-21 23:35:58 +02:00

state.ts

feat: web setup wizard + admin config/state dir split (#226)

2026-05-09 17:37:41 +02:00

token.ts

feat: web setup wizard + admin config/state dir split (#226)

2026-05-09 17:37:41 +02:00

url-token.ts

fix: keep the setup token out of access logs, referers and history

2026-09-26 16:32:38 +02:00