4 Commits

Author	SHA1	Message	Date
decolua	628ff1eab5	fix(auth): set 24h maxAge for dashboard session cookie ... Co-Authored-By: Claude Code <noreply@anthropic.com>	2026-09-09 09:45:23 +07:00
decolua	0c7c9de00a	fix(security): re-auth on DB export/import + SSRF guard on web fetch ... - /api/settings/database now requires current password (header for GET, body for POST) in addition to session; CLI-token requests exempt - add verifyDashboardPassword helper reusing login bcrypt check - profile UI prompts password via modal before export/import - /v1/web/fetch rejects internal/private/metadata targets via assertPublicUrl Refs GHSA-qvfm-67h2-2qfx, GHSA-qj3v-64wj-q825 Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-13 11:40:35 +07:00
decolua	fe3ce25ae3	Update JWT_SECRET handling	2026-05-15 09:31:34 +07:00
Walter Cheng	c3d91b019b	Add OIDC dashboard auth (#1020)	2026-05-12 09:43:42 +07:00