Login/security refinements#6
Merged
SiteRelEnby merged 5 commits intomainfrom Apr 26, 2026
Merged
Conversation
Previously 32 bits (token_hex(4)) — feasible to brute-force offline given enough compute. Each code is now 16 hex chars formatted as XXXXXXXX-XXXXXXXX for readability when users transcribe them from paper backups.
iss is sheaf_base_url when configured (tying tokens to the origin that issued them) or the string "sheaf" otherwise. aud is "sheaf-api". decode_token now enforces both plus exp / iat / sub via pyjwt's require option, so an access token minted for a different deployment or with a missing standard claim fails to validate. Tokens issued before this change lack the new claims and will fail decode, forcing one re-login.
Gated on the current password and, when TOTP is enabled, a fresh code or recovery code. On success the calling session stays alive but every other session for the user is revoked, so a stolen cookie elsewhere can't survive the change. Refresh tokens bound to revoked sessions fail at /refresh's session-existence check.
Same auth gate as change-password — current password plus TOTP if enabled. The new address has email_verified flipped back to false and a verification mail goes out; pre-apply verification doesn't actually defend against session compromise (the attacker controls the destination inbox), so the password+TOTP gate is the real protection and the re-verify is a typo safety net. Other sessions revoked too.
Optional 30-day cookie that skips TOTP on a trusted browser. Cookie is HMAC-hashed in the DB and bound to user_id so it can't be replayed against another account. Auto-revoked on password change and TOTP disable; manual revoke per-device or all-at-once from settings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Smaller changes to login flow and security model
Changes
Testing
ruff check sheaf/passescd web && npm run lint && npx tsc --noEmitpassesSecurity / privacy impact