mteehan 6404508519 fix: harden auth with refresh token session binding, logging, and router state ...

- Add session_id to refresh tokens and enforce it during validation,
  preventing stolen refresh tokens from being usable without the
  originating browser session
- Set router.isAuthenticated via auth:login event after successful
  login (previously only set at page load)
- Add console.warn logging to WS message parse/handler errors
- Improve _refreshPromise error handling in token refresh flow
- Document rate limiter in-memory limitation and CSP connect-src
  same-origin requirement
- Add 3 tests for session-bound refresh token validation

2026-08-12 15:53:17 +00:00

..

hoover

fix: harden auth with refresh token session binding, logging, and router state

2026-08-12 15:53:17 +00:00

pages

security: harden builtin admin pwd logging and fix auth token persistence

2026-08-12 14:54:07 +00:00

vendor

docs: update documentation and project structure

2026-07-02 14:41:02 +00:00

app.js

fix: harden auth with refresh token session binding, logging, and router state

2026-08-12 15:53:17 +00:00

index.html

Remove query-string cache-busting from static assets

2026-07-28 13:50:22 +00:00

style.css

feat: add system metrics dashboard with resource monitoring

2026-07-15 00:24:43 +00:00