cgalo5758 ea4fee18b6 Fix five findings from security audit run 2 ...

- Rotate the session token at the OIDC callback and restore the full
  lifetime; cap pre-auth sessions at 15 minutes and write no session
  for bare anonymous requests
- Treat db-dsn as a secret: accept db-dsn-file, log only host, port,
  database and user, and never echo a malformed DSN in an error
- Guard the logout callback with a state cookie so a forged visit
  cannot end a live session
- Collapse FedWiki site actions on a foreign tenant's domain to the
  not-found answer, as for a domain that does not exist

2026-09-09 20:53:31 -05:00

..

config_reference_test.go

Add dual licensing and SPDX headers

2026-09-06 02:29:42 -05:00

config_reference_types_test.go

Add dual licensing and SPDX headers

2026-09-06 02:29:42 -05:00

deployment_test.go

Add dual licensing and SPDX headers

2026-09-06 02:29:42 -05:00

deployment.go

Add dual licensing and SPDX headers

2026-09-06 02:29:42 -05:00

overlay_test.go

Add dual licensing and SPDX headers

2026-09-06 02:29:42 -05:00

overlay.go

Add dual licensing and SPDX headers

2026-09-06 02:29:42 -05:00

spec_test.go

Add dual licensing and SPDX headers

2026-09-06 02:29:42 -05:00

spec.go

Remediate security audit findings

2026-09-09 13:25:43 -05:00

transport_test.go

Remediate security audit findings

2026-09-09 13:25:43 -05:00

transport.go

Remediate security audit findings

2026-09-09 13:25:43 -05:00

validate_test.go

Fix five findings from security audit run 2

2026-09-09 20:53:31 -05:00

validate.go

Fix five findings from security audit run 2

2026-09-09 20:53:31 -05:00