3 people 77251f5038 fix(security): remember a single sign-on sign-in (#116) ...

OidcAuthenticator issued no RememberMeBadge, so an OIDC login rested on the
PHP session alone: a browser-session cookie, a file cleaned up after the 24
minute session.gc_maxlifetime, and lost with the container on every deploy.
The badge now carries the firewall's remember-me parameter, because the
callback has no form to tick it on; always_remember_me would instead make the
password form's unticked checkbox meaningless. The token is stored in the
database and a remember-me cookie is still challenged by two-factor.

Co-authored-by: Flouss <15911342+Flouss@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

2026-10-14 16:39:04 +02:00

..

TwoFactor

Stop a background request deciding where signing in takes you

2026-10-07 16:28:07 +02:00

Voter

…

DeactivatedAccountTest.php

…

JmapAuthenticationTest.php

test(security): pin the JMAP firewall's refusals

2026-09-23 19:37:29 +02:00

LoginThrottlingTest.php

fix(security): add a per-username login limit

2026-09-23 19:37:15 +02:00

LogoutCsrfTest.php

fix(security): require a CSRF token to log out

2026-09-23 19:37:15 +02:00

OidcAuthenticatorRememberMeTest.php

fix(security): remember a single sign-on sign-in (#116)

2026-10-14 16:39:04 +02:00

RememberMeAcrossRestoreTest.php

Keep remember-me tokens on the server, so signing out holds (#104)

2026-10-13 17:18:43 +02:00

RememberMeSignOutTest.php

Keep remember-me tokens on the server, so signing out holds (#104)

2026-10-13 17:18:43 +02:00

StatelessCsrfOriginTest.php

…