AgeCommit message (Expand)AuthorLines
Check that the secret keys every signatureBryce Kwon-0/+12
Check that the auth secret is made safelyBryce Kwon-8/+82
Give each auth unit run a directory of its ownBryce Kwon-16/+18
Read the login form table as layoutBryce Kwon-0/+1
Log failed loginsBryce Kwon-0/+7
Say that logging in needs httpsBryce Kwon-1/+12
Tell a signed-in visitor they have no accessBryce Kwon-0/+7
Say when logins are unavailableBryce Kwon-1/+16
Write a session's expiry in whole secondsBryce Kwon-0/+11
Share the request helpers in the auth checksBryce Kwon-77/+49
Drop auth guards for input cgit never sendsBryce Kwon-3/+4
Strip control characters from the location aloneBryce Kwon-2/+0
Take a signed cookie apart with one matchBryce Kwon-0/+1
Say when a login fails, and line up the formBryce Kwon-1/+11
Name the auth cookie __Host- where it can beBryce Kwon-26/+51
End a session when its account's hash changesBryce Kwon-4/+20
Load auth libraries only when a request needs oneBryce Kwon-0/+13
Spend a missing account's login on a real hashBryce Kwon-36/+51
Turn down passwords past 256 bytes uncheckedBryce Kwon-0/+22
Read the auth cookie in linear timeBryce Kwon-0/+10
Refuse every repository when auth-file loses reposBryce Kwon-0/+13
Clean up the whole treeBryce Kwon-62/+31
Add a test suite for the shipped extensionsBryce Kwon-0/+302