Oxicloud

Files

T

Dionisio d2c08d31ba feat(security): HttpOnly cookies + CSP headers + CSRF double-submit protection

- Migrate auth tokens from localStorage to HttpOnly SameSite=Lax cookies
- Add cookie_auth.rs: helpers for setting/clearing auth + CSRF cookies
- Update auth middleware: 3-method auth (Bearer → Basic → Cookie)
- Add 5 security headers: CSP, X-Content-Type-Options, X-Frame-Options,
  Referrer-Policy, Permissions-Policy
- Implement CSRF double-submit cookie pattern (csrf.rs middleware)
- Set CSRF cookie on login/refresh/oidc-exchange, clear on logout
- CookieAuthenticated marker skips CSRF for Bearer/Basic clients
- Frontend: strip all localStorage token refs from 14 JS files
- Frontend: csrf.js utility + all 52 mutating fetch/XHR calls protected
- 121 tests passing, 0 warnings

2026-03-03 01:10:50 +01:00

css

Add navigation and copy functionality to move dialog

2026-02-24 21:02:28 -08:00

feat(security): HttpOnly cookies + CSP headers + CSRF double-submit protection

2026-03-03 01:10:50 +01:00

locales

feat: improve move dialog with folder navigation

2026-02-24 17:56:25 -08:00

logo

Delete static/logo/logo-plain.svg:Zone.Identifier

2025-04-15 11:06:09 +02:00