b23ac40c0b
- login with 2FA on returns a 5-minute challenge, not a session; the session comes from /relay/2fa/verify with an authenticator code — or one of eight recovery codes, each good once (hash slot emptied) - /relay/2fa/enroll hands out the secret (QR) + codes once; enabling completes only when a real code proves the app has the secret; disable proves the code - /relay/sessions/logout kicks every device of the account from one page - password hashes are argon2id (memory-hard, OWASP parameters); stored PBKDF2 hashes still sign in — no forced reset, upgrade on next password change - TOTP is RFC 6238 (vectors pinned in tests); mobile page prompts for the second step; protocol.md documents the endpoints - fixes a double-lock in /relay/me found by the flow test (handlers hold one data guard: read through it) |
||
|---|---|---|
| .. | ||
| icon-180.png | ||
| icon-192.png | ||
| icon-512.png | ||
| icon.svg | ||
| index.html | ||
| novnc.js | ||
| screen.html | ||
