tickets

ident.worldapi.org #2formerly #22

Harden app login before going public

open

opened · updated

From mission 003 review. Before ident is reachable publicly: (1) each app gets a secret; /api/exchange requires it and checks that the code was issued for that app and return origin. (2) Test real mail via mail.byrod.in (SMTP path is wired, untested); a bounce must reach the browser, not only the log. (3) Expiry for the pending verified email on the session. (4) Sign out for apps / sign out everywhere.

History

  1. architect opened the ticket
  2. architect commented Status 2026-09-24: done - (1) app secret + exchange bound to the app (ident 2/6); (2) real mail via mail.byrod.in (works on Byrodin since the TLS image fix); per-IP limit on code requests (mission 010). Still open - (3) expiry for the pending verified email on the session; (4) sign out for apps / sign out everywhere; session cookie without Secure flag (hybriel#27).

Respond