fatchan/jschan - jschan - TurnKey Gitea

Author	SHA1	Message	Date
Thomas Lynch	d20744d897	twofactor page model translation	2 years ago
Thomas Lynch	29bb4856ab	2fa improvements - Don't allow code re-use, successfully used codes will be invalid on repeated use for the window time - Don't attach the full twofactor secret to user object in session for security. Only store a boolean if it's enabled for rendering, checks, etc. The full account should be fetched first before doTwoFactor() - Better names for some keys of twofactor redis stuff	2 years ago
Thomas Lynch	e5d0f9871f	Add text version of secret to twofactor.html for people without/who dont want to use a camera or screenshot the image Add warning to twofactor.html that other sessions will be logged out and they have to log in again Change cache-control header to no-cache, even though private is secure (prevent showing cached page without outdated secret)	2 years ago
Thomas Lynch	b93bab7faf	Switch speakeasy -> otpauth (maintained, more modern, actively developed) Remove dev debug skip of 2fa generation ratelimit Shorten totp validity window Remove ugly stuff from login/changepassword forms, change wording	2 years ago
Thomas Lynch	4d86406483	Initial commit of 2FA for accounts, TOTP-based	2 years ago