6 Commits (0e9c9883738c71d192a6b79ec3d3f3f982925ed5)

Author	SHA1	Message	Date
KN4CK3R	c6c829fe3f	Enhanced auth token / remember me (#27606) ... Closes #27455 > The mechanism responsible for long-term authentication (the 'remember me' cookie) uses a weak construction technique. It will hash the user's hashed password and the rands value; it will then call the secure cookie code, which will encrypt the user's name with the computed hash. If one were able to dump the database, they could extract those two values to rebuild that cookie and impersonate a user. That vulnerability exists from the date the dump was obtained until a user changed their password. > > To fix this security issue, the cookie could be created and verified using a different technique such as the one explained at https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies. The PR removes the now obsolete setting `COOKIE_USERNAME`.	1 year ago
JakobDev	7047df36d4	Another round of `db.DefaultContext` refactor (#27103) ... Part of #27065 --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>	1 year ago
JakobDev	c548dde205	More refactoring of `db.DefaultContext` (#27083) ... Next step of #27065	1 year ago
Lunny Xiao	0a7d3ff786	refactor some functions to support ctx as first parameter (#21878) ... Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Lauris BH <lauris@nix.lv>	2 years ago
flynnnnnnnnnn	e81ccc406b	Implement FSFE REUSE for golang files (#21840) ... Change all license headers to comply with REUSE specification. Fix #16132 Co-authored-by: flynnnnnnnnnn <flynnnnnnnnnn@github> Co-authored-by: John Olheiser <john.olheiser@gmail.com>	2 years ago
Lunny Xiao	de8e3948a5	Refactor auth package (#17962)	3 years ago