Skip to content

v0.11.0

Choose a tag to compare

View all tags
@xgame92 xgame92 released this 07 Nov 11:48
v0.11.0
bb8632a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changing a password now tells the person and always ends every other session. No migration.

Security

  • A password change told nobody, and the server ended other sessions only when the page asked. It now emails the person, which may be how they first hear that someone else has the password, and ends every other session whatever the request asks. Apps signed in through those sessions hear of it by back-channel logout, as they did when the page asked, so this browser signs in to them again too. (#84)
  • /change-password takes five tries a minute, in place of Better Auth's three in ten seconds. (#84)

If you run your own

  • A first password and a reset send no such email. The first is the next step of signing up, and a reset's own email started it. On a server without email, nothing is sent and the rest still happens.
Assets 2
Loading