mteehan c7593f8a1e fix: close refresh token session binding bypass ...

Add require_session parameter to validate_token to enforce session_id
matching for refresh operations. Attacker with stolen refresh token can
no longer bypass session binding by omitting session_id from request.

Also adds backend guard against deleting builtin admin user (was only
blocked at Flask blueprint layer), and removes unused _ALL_RW variable.

2026-08-12 20:06:05 +00:00

..

__init__.py

refactor: introduce two-user daemon architecture with socket-based communication

2026-05-27 23:39:33 +00:00

acme.py

feat: auto-generate self-signed certs, hoover modal processing guard, refactor backends/proxy pages

2026-07-13 14:30:35 +00:00

auth.py

fix: close refresh token session binding bypass

2026-08-12 20:06:05 +00:00

dnsmasq.py

fix: critical bugs + security hardening

2026-07-11 12:21:36 +00:00

firewall.py

WireGuard access classes, firewall nftables fixes, network sync event refactor

2026-07-20 03:57:16 +00:00

logs.py

refactor: overhaul daemon server, client, and handlers

2026-06-16 03:50:00 +00:00

network.py

WireGuard access classes, firewall nftables fixes, network sync event refactor

2026-07-20 03:57:16 +00:00

nginx.py

feat: auto-generate self-signed certs, hoover modal processing guard, refactor backends/proxy pages

2026-07-13 14:30:35 +00:00

status.py

Add update-vendor.sh symlink support, unify install.sh vendor flow

2026-07-01 00:55:03 +00:00

system.py

feat: add system metrics dashboard with resource monitoring

2026-07-15 00:24:43 +00:00

wireguard.py

feat: add auth subsystem with WebAuthn passkeys support

2026-07-24 01:21:39 +00:00