ZacharyZcR 8c3f816407 fix: only trust the server's origin in the desktop login frame (#1624) ...

The desktop sign-in iframe accepted AUTH_SUCCESS and system browser requests from whatever page it had navigated to, and posted replies (including 2FA temp tokens) to any origin. Messages must now come from the server's origin and replies are posted to it.

The web UI also treated any framing page as the desktop app and posted the JWT to it. It now also requires the Termix-Desktop user agent.

2026-10-14 08:12:53 +08:00

..

auth-bits.tsx

v26.10.0 (#1573)

2026-10-10 14:58:27 -05:00

Auth.tsx

v26.10.1 (#1599)

2026-10-12 11:35:48 -05:00

ElectronLoginForm.tsx

fix: only trust the server's origin in the desktop login frame (#1624)

2026-10-14 08:12:53 +08:00

silent-signin.ts

v2.3.0

2026-05-28 22:29:20 -05:00