openhands ac60a867d9 security: harden authentication (register/login) ...

- Username: restrict to [A-Za-z0-9_-], block reserved names (admin, mod, root, etc.),
  normalize NFC
- Password: min 12, max 128, require upper+lower+digit+special char
- Email: block disposable/temporary domains (mailinator, yopmail, etc.)
- Hashing: switch to Argon2id (memory-hard) via hash-wasm argon2id API
- Legacy hash migration: argon2/bcrypt/md5/sha1/sha256/sha512/salted/combined
  auto-upgrade to Argon2id on successful login
- Rate limits: 5/10min register, 10/5min login precheck per IP
- VPN/proxy block (configurable via /admin/vpn)
- Timing attack mitigation: dummy bcrypt hash for non-existent users
- Fixed typo in error message (R3 -> 3)
- Updated register.test.ts to match new validation rules

2026-09-21 19:33:13 +02:00

..

email-verification-boundary.test.ts

fix(security): authorize site uploads and harden tokens, media and request identity

2026-09-13 19:24:43 +02:00

email-verification.ts

fix(security): authorize site uploads and harden tokens, media and request identity

2026-09-13 19:24:43 +02:00

jwt-version-cache.test.ts

refactor(db): migrate app pages and APIs from Prisma facade to Drizzle (5)

2026-08-01 14:15:39 +02:00

jwt-version-cache.ts

refactor(db): migrate app pages and APIs from Prisma facade to Drizzle (5)

2026-08-01 14:15:39 +02:00

laravel-encrypter.test.ts

style: format code biome

2026-07-13 21:57:41 +02:00

laravel-encrypter.ts

style: format code biome

2026-07-13 21:57:41 +02:00

login-core.ts

refactor(db): typed query helpers, shared test FormData helper

2026-09-17 21:02:57 +02:00

password.test.ts

style(auth): satisfy Biome in password digest helpers

2026-09-18 12:44:44 +02:00

password.ts

security: harden authentication (register/login)

2026-09-21 19:33:13 +02:00

personal-token-abilities.ts

fix(security): authorize site uploads and harden tokens, media and request identity

2026-09-13 19:24:43 +02:00

personal-token-scope.test.ts

tests: fix TS errors in new test files with @ts-nocheck

2026-07-30 18:50:28 +02:00

personal-token-scope.ts

style: format code biome

2026-07-13 21:57:41 +02:00

session-user.test.ts

Improvements: remove dead config, fix ESM, add URL validation, unify types, add missing logging

2026-07-26 20:28:11 +02:00

session-user.ts

style: format code biome

2026-07-13 21:57:41 +02:00

sign-in-retry.test.ts

fix: retry login across deploy cutovers

2026-08-02 11:31:35 +02:00

sign-in-retry.ts

fix: retry login across deploy cutovers

2026-08-02 11:31:35 +02:00

sso-ticket.test.ts

fix: harden SSO ticket flow and revoke tickets on logout

2026-08-29 20:54:06 +02:00

sso-ticket.ts

fix: harden SSO ticket flow and revoke tickets on logout

2026-08-29 20:54:06 +02:00

totp.test.ts

style: format code biome

2026-07-13 21:57:41 +02:00

totp.ts

chore: patch deps, CSP style nonces, otplib 13, and PR CI

2026-07-21 20:46:02 +02:00

twofactor-verification.ts

refactor(auth): single digest registry, extracted 2FA and login-log, dep bumps

2026-09-17 15:26:25 +02:00

website-login-log.ts

refactor(auth): single digest registry, extracted 2FA and login-log, dep bumps

2026-09-17 15:26:25 +02:00