Linus Rath d155cead41 fix: revoke Lite refresh tokens on sign-out and keep no failed-login password ...

Signing out of Lite only deleted the refresh token from web storage, so
a copy taken from the browser kept working until it expired. Sign-out
now revokes it at the endpoint the mail server (or, for an external
provider, its discovery document) advertises, once the token is gone
from storage.

A password login whose token exchange failed for any reason fell back to
Basic auth and kept the password in sessionStorage. The password is now
only kept for the tab when the server has no token login at all (or
cannot be reached for it); otherwise the Basic session lives in memory
and a reload asks to sign in again.

2026-09-26 17:15:55 +02:00

..

(main)

fix: revoke Lite refresh tokens on sign-out and keep no failed-login password

2026-09-26 17:15:55 +02:00

(sandbox)

feat: add privileged same-origin plugin tier + crypto API surface

2026-06-28 16:51:42 +02:00

api

fix: keep the mock JMAP server out of release builds

2026-09-26 17:07:31 +02:00

global-error.tsx

fix: load app styles on the global error page

2026-09-22 19:39:39 +02:00

globals.css

refactor: migrate icon set from Lucide to Tabler Icons

2026-09-19 13:32:41 +02:00

manifest.ts

Feature: configurable PWA install screenshots (per-domain)

2026-05-30 15:45:59 +02:00