74a9ca98ad
♻️ Refactor OpenID: Phase 2: Security Hardening - PKCE Implementation
...
- Added GenerateCodeVerifier() and GenerateCodeChallenge() methods to base OidcService
- Implemented PKCE (Proof Key for Code Exchange) for Google OAuth flow:
* Generate cryptographically secure code verifier (256-bit random)
* Create SHA-256 code challenge for authorization request
* Cache code verifier with 15-minute expiration for token exchange
* Validate and remove code verifier during callback to prevent replay attacks
- Enhances security by protecting against authorization code interception attacks
- Uses S256 (SHA-256) code challenge method as per RFC 7636
2025-11-02 15:05:19 +08:00
4bd59f107b
♻️ Refactor OpenID: Phase 1: Code Consolidation optimizations
...
- Add BuildAuthorizationParameters() method to reduce authorization URL duplication
- Update GoogleOidcService to use common parameter building method
- Add missing using statements for AppDatabase and AuthService namespaces
- Improve code reusability and eliminate 20+ lines of repeated authorization logic per provider
2025-11-02 15:05:04 +08:00
08f924f647
💄 Optimize oidc provider
2025-11-02 14:35:02 +08:00
5445df3b61
♻️ Optimized auth service
2025-11-02 14:26:07 +08:00
dd5929c691
💥 Moved the /id to /pass and bug fixes of moved realms
2025-10-22 22:52:09 +08:00
c64adace24
💄 Using remote site instead of embed frontend (removed) to handle oidc redirect
2025-10-06 13:05:50 +08:00
8ac0b28c66
🚚 Move callback to under api
2025-10-06 13:01:15 +08:00
8f71d7f9e5
🐛 Fix some bugs
2025-10-06 12:46:25 +08:00
e7aa887715
🐛 Fix wrong signing algo
2025-10-04 19:55:27 +08:00
0f05633996
🐛 Fix oidc didn't provides with authorized party
2025-10-04 19:03:57 +08:00
9ce31c4dd8
♻️ Finish centerlizing the data models
2025-09-27 15:14:05 +08:00
e70d8371f8
♻️ Centralized data models (wip)
2025-09-27 14:09:28 +08:00
4910c3296b
🐛 Fix openid configuration outdated
2025-09-26 00:13:46 +08:00
5c97733b3e
💥 Rename Pusher to Ring
2025-09-14 19:42:51 +08:00
be6d97ec85
🐛 Session will expired
2025-09-13 16:31:23 +08:00
4a8521d59d
🐛 Refactor to fix GeoIP
2025-09-07 14:57:44 +08:00
52430c19a5
🐛 Enable JsonNumberHandling.AllowNamedFloatingPointLiterals global wide
2025-09-07 14:39:25 +08:00
5f324a2348
🐛 Ignore point data to avoid cycling
2025-09-07 12:23:03 +08:00
d7271a2d11
🐛 Fix odic stuff
2025-09-02 00:33:47 +08:00
fb6721cb1b
💄 Optimize punishment reason display
2025-08-26 20:32:07 +08:00
d299c32e35
♻️ Clean up OIDC provider
2025-08-25 23:53:04 +08:00
344007af66
🔊 Logging more ip address
2025-08-25 23:42:41 +08:00
d4de5aeac2
🐛 Fix api key exists cause regular login 500
2025-08-25 23:30:41 +08:00
5a44952b27
🐛 Fix oidc token aud
2025-08-25 23:17:40 +08:00
c30946daf6
🐛 Still bug fixes in auth service
2025-08-25 23:01:17 +08:00
c44b0b64c3
🐛 Fix api key auth issue
2025-08-25 22:39:35 +08:00
442ee3bcfd
🐛 Fixes in auth service
2025-08-25 22:24:18 +08:00
eab2a388ae
🐛 Fixes in authorize
2025-08-25 21:22:04 +08:00
8c748fd57a
✨ Bring OIDC back
2025-08-25 02:44:44 +08:00
7cb14940d9
🐛 Fix rotate key
2025-08-24 01:49:48 +08:00
953bf5d4de
✨ Bot controller has keys endpoints
2025-08-23 19:52:05 +08:00
3b679d6134
✨ API Keys
2025-08-20 13:41:06 +08:00
66eadf96b0
🐛 Fix randomly account got logged out
2025-08-18 20:56:25 +08:00
32e91da0b2
🐛 Fix circular dependecy
2025-08-18 16:34:07 +08:00
69b56b9658
🔊 Logging auth flow
2025-08-18 16:19:21 +08:00
d4a2e5ef5b
♻️ Refactored auth controller
2025-08-18 00:14:18 +08:00
2761abf405
✨ Login now send a notification
2025-08-17 23:43:13 +08:00
8e8965eb3d
👔 Send factor code no longer requires hint
2025-08-17 21:20:42 +08:00
614c77d7ce
🐛 Fix compile failed
2025-08-16 14:35:06 +08:00
07ba148d9b
🐛 Fix challege pickup
2025-08-16 14:30:58 +08:00
917e2d5393
🐛 Fix post get API missing the reference post
2025-08-16 11:59:29 +08:00
48f776e6ff
✨ Post slug 🐛 Fix duplicate device id
2025-08-15 12:19:36 +08:00
a27bda4720
🐛 Fix web didn't has device name
2025-08-15 12:10:59 +08:00
7ec3f25d43
🐛 Fix action logs
2025-08-14 02:29:16 +08:00
1778ab112d
✨ Authorized device
2025-08-14 02:21:59 +08:00
5f70d53c94
✨ New authorized device
2025-08-14 02:10:32 +08:00
f8d8e485f1
♻️ Refactored the authorized device (now client)
2025-08-13 15:27:31 +08:00
76fdf14e79
♻️ Refactored authorize device system (wip) (skip ci)
2025-08-13 02:04:26 +08:00
e7d14d4687
✨ Punishment block login and disable account
2025-08-08 15:42:17 +08:00
77ccc9aeb5
✨ Develop service
2025-08-08 00:47:26 +08:00
