5 commits

Author	SHA1	Message	Date
mwiegand	3490be5fb7	auth: reject inactive users at login + invalidate existing sessions ... Two-pronged enforcement so deactivation has effect both for fresh logins and already-issued sessions: - load_current_user(): treat User with active=False as logged-out (sets g.user=None). Existing sessions stop working immediately. - login(): include `not user.active` in the existing 401 condition, so deactivated accounts get the same "invalid credentials" response as wrong-password / unknown-user — no timing oracle for deactivation status. Tests still green (12/12 in test_auth.py).	2026-05-10 21:13:31 +02:00
mwiegand	df680f6226	fix(l4d2-web): reject encoded unsafe redirects	2026-05-06 13:24:04 +02:00
mwiegand	58fb8b2b63	fix(l4d2-web): harden auth redirect targets	2026-05-06 13:01:48 +02:00
mwiegand	0aca36506f	feat(l4d2-web): add login page and safe redirects	2026-05-06 12:52:22 +02:00
mwiegand	288eda7c37	chore(l4d2): flatten component layout	2026-05-05 23:47:06 +02:00

Renamed from components/l4d2-web-app/src/l4d2web/auth.py (Browse further)