Linus Rath c395226926 fix: reject wrong passwords server-side so the browser never shows its Basic Auth dialog #969

2026-09-09 19:21:40 +02:00

..

impersonate

fix(impersonation): reconcile stale persisted account chip after handoff

2026-07-27 05:20:53 +03:00

oauth/metadata

fix: discover OIDC metadata server-side to avoid CORS failures #382

2026-06-02 00:15:50 +02:00

pair

feat: require re-authentication for device pairing and SSO

2026-06-05 19:23:06 +02:00

reauth/sso/complete

feat: require re-authentication for device pairing and SSO

2026-06-05 19:23:06 +02:00

session

fix: honor cookieSameSite admin config override #284

2026-05-14 21:49:37 +02:00

sso

fix: drop max_age=0 from OIDC re-authentication requests #938

2026-09-07 22:34:47 +02:00

stalwart-context

fix: bind stalwart auth context to credential, not cookie-claimed username

2026-05-18 13:00:40 +02:00

token

fix: refresh TOTP-minted tokens with the default client id when no OAuth client is configured #873

2026-08-20 13:59:57 +02:00

totp-token-exchange

fix: pin resolved IP at connect time to block DNS-rebinding SSRF (GHSA-24w9-8r42-8jwm)

2026-08-26 22:11:06 +02:00

verify

fix: reject wrong passwords server-side so the browser never shows its Basic Auth dialog #969

2026-09-09 19:21:40 +02:00