Account forms: one guard for every form, Turnstile, and no email-taken leak by codeGlaze · Pull Request #80 · codeGlaze/orcpub

Limit resend-verification mail per address and per host, as password reset is

codeGlaze

committed

dffcbc1

Test password reset limits per address and per host and the uniform answer

codeGlaze

committed

e082c3b

Ask for a Cloudflare Turnstile check on sign-up when both keys are set

codeGlaze

committed

07cff99

Move the Turnstile server check into security and its tests with it

codeGlaze

committed

e902c87

Move the account and sign-in handlers out of routes into routes.auth

codeGlaze

committed

1e10700

Move the shared form helpers from views into components

codeGlaze

committed

5368b96

Move the account screens and the Turnstile widget into views/auth

codeGlaze

committed

1514cdd

Move the account events into events/auth

codeGlaze

committed

97a6173

Move page wrappers into orcpub.index and reset-password-page into routes.auth

codeGlaze

committed

1563000

Move the auth card's inline styles into Garden

codeGlaze

committed

1f5a4b3

Reset the Turnstile widget through an effect

codeGlaze

committed

7eae494

Add one guard table for the account endpoints and a test against the route table

codeGlaze

committed

790f342

Put Turnstile on password reset, resend verification and sign-in after a failure

codeGlaze

committed

90116b1

Say so when the security check cannot load, and tell a missing token from a failed one

codeGlaze

committed

cee9f0f

Sign-up no longer reveals a taken email: same answer, the owner is mailed

codeGlaze

committed

ead18a5

Let the security-check warning be dismissed

codeGlaze

committed

93cdb2d

Auth forms: one policy table and one guard

codeGlaze

committed

8bc2b6e

Owner notices: one claim-notice! with a cadence

codeGlaze

committed

9d7c564

Auth forms: the page shell and one request interceptor carry the protection

codeGlaze

committed

1aa919e

Take the login challenge flag from the guard table

codeGlaze

committed

710a241

Branch changelog for fix/auth-abuse

codeGlaze

committed

58cf1c5

Close auth-abuse review findings: configured-URL notices, Turnstile 4xx and non-text tokens, bounded challenge checks and memory, conditional re-verify, released notice claims

codeGlaze

committed

cbbe7a9

Build account-mail links from the configured site URL

codeGlaze

committed

ede36a0

Put the abuse limits' state behind a LimitStore, with an optional shared Redis store

codeGlaze

committed

8aedfe9

Navigation Menu

Repository navigation

Account forms: one guard for every form, Turnstile, and no email-taken leak - #80

Account forms: one guard for every form, Turnstile, and no email-taken leak#80
codeGlaze merged 27 commits into
integrationfrom
fix/auth-abuse

Commits on Nov 4, 2026

Limit resend-verification mail per address and per host, as password reset is

Test password reset limits per address and per host and the uniform answer

Ask for a Cloudflare Turnstile check on sign-up when both keys are set

Move the Turnstile server check into security and its tests with it

Move the account and sign-in handlers out of routes into routes.auth

Move the shared form helpers from views into components

Move the account screens and the Turnstile widget into views/auth

Move the account events into events/auth

Move page wrappers into orcpub.index and reset-password-page into routes.auth

Move the auth card's inline styles into Garden

Reset the Turnstile widget through an effect

Add one guard table for the account endpoints and a test against the route table

Put Turnstile on password reset, resend verification and sign-in after a failure

Say so when the security check cannot load, and tell a missing token from a failed one

Sign-up no longer reveals a taken email: same answer, the owner is mailed

Let the security-check warning be dismissed

Auth forms: one policy table and one guard

Owner notices: one claim-notice! with a cadence

Auth forms: the page shell and one request interceptor carry the protection

Take the login challenge flag from the guard table

Branch changelog for fix/auth-abuse

Close auth-abuse review findings: configured-URL notices, Turnstile 4xx and non-text tokens, bounded challenge checks and memory, conditional re-verify, released notice claims

Build account-mail links from the configured site URL

Put the abuse limits' state behind a LimitStore, with an optional shared Redis store

Commits on Nov 5, 2026

Close the verified-account oracle in re-verify and tidy auth follow-ups

Drop the dead X-Frame-Options ALLOW-FROM header from character pages

Fold the fix/auth-abuse changelog into the Summer Patch