Linus Rath f9af701bb9 fix: keep the Lite session when the token endpoint is only rate limiting ...

Bulwark Lite deleted the remembered refresh token on any non-5xx error
from `/auth/token`, so a 429 or 408 during a busy moment signed the
user out for good. Like the server build, it now clears the token only
when the server refuses it (400, 401, 403) and treats everything else
as an outage.

2026-09-26 16:17:29 +02:00

..

active-account-slot.ts

fix: harden proxy auth and SSRF defenses

2026-03-31 17:47:09 +02:00

crypto.ts

fix: keep the Stalwart master password out of impersonated sessions

2026-09-26 14:05:05 +02:00

lite-oauth.ts

feat: add OpenID Connect login to the Stalwart Lite bundle

2026-09-21 23:45:08 +02:00

lite-tokens.ts

fix: keep the Lite session when the token endpoint is only rate limiting

2026-09-26 16:17:29 +02:00

pair-reauth.ts

fix: bind a purpose into encrypted payloads (GHSA-cqqx-mjcf-mh55)

2026-09-17 20:16:51 +02:00

pairing-store.ts

feat: add QR code device pairing for mobile app login

2026-06-05 17:41:55 +02:00

session-cookie.ts

feat: lift 5-account cap on HTTP/2

2026-05-07 12:28:33 +02:00

session-secret.ts

feat: add sessionSecretFile and oauthClientSecretFile for JSON config

2026-05-31 00:14:38 +02:00

verification-failure.ts

fix: explain why calendar subscriptions fail with not authenticated #1073

2026-09-23 18:31:27 +02:00

verify-jmap-auth.ts

fix: key synced settings on the account a bearer token belongs to

2026-09-26 14:59:55 +02:00