MHSanaei ce532e8df7 fix(web): start a fresh session at login ...

SetLoginUser added the user to whatever session the login request
carried, so its CSRF token outlived the login. Anyone can fetch an
anonymous session with its token, and a host on a sibling domain can
plant that cookie in the admin's browser. Clear the session before the
user is stored; the next page load or token fetch mints a new token.

2026-10-31 09:05:28 +00:00

..

csrf.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

session_test.go

fix(web): start a fresh session at login

2026-10-31 09:05:28 +00:00

session.go

fix(web): start a fresh session at login

2026-10-31 09:05:28 +00:00