Repository navigation
🔐 Security-Focused Update
-
JWT Refresh Token Support
Implemented support for refresh tokens with persistent storage in the database, enabling safer long-term authentication and token renewal flows. -
Stronger Password Change Flow
Password changes now require the current password and an active session. Additionally, changing the password revokes all existing sessions across all devices, enhancing account security. -
Session Tracking and Management
Each login session now stores the user's IP address and device information. A new endpoint allows users to view all active sessions and revoke any specific session—or all sessions at once—for complete session control. -
UUID Migration
All primary keys across entities have been migrated from numeric IDs to UUIDs, improving database security and consistency. -
User Status Enum
Replaced the active boolean with a status enum to support more detailed account states: pending_verification (coming soon), active, deletion_requested, and locked. -
Brute Force Protection
Introduced progressive delays after failed login attempts based on IP and device fingerprinting, limiting brute-force attacks without blocking legitimate users too early. -
Forgot Password Flow
Added a new endpoint to request a password reset via email. Users receive a secure token to set a new password, allowing recovery even without an active session.
Full Changelog: v1.0.0...v1.2.0