6 Commits

Author	SHA1	Message	Date
Toby Zerner	9896378b59	Overhaul sessions, tokens, and authentication ... - Use cookies + CSRF token for API authentication in the default client. This mitigates potential XSS attacks by making the token unavailable to JavaScript. The Authorization header is still supported, but not used by default. - Make sensitive/destructive actions (editing a user, permanently deleting anything, visiting the admin CP) require the user to re-enter their password if they haven't entered it in the last 30 minutes. - Refactor and clean up the authentication middleware. - Add an `onhide` hook to the Modal component. (+1 squashed commit)	2015-12-03 15:11:57 +10:30
Toby Zerner	26a821e3e2	Improve client XHR error handling ... The default XHR error handler produce an alert which is appropriate to the response status code. It can be overridden per-request (by specifying the `errorHandler` option) so that the alert can be suppressed or displayed in a different position (e.g. inside a modal). ref #118	2015-10-20 12:48:26 +10:30
Toby Zerner	d5b58b3146	Only set XHR authorization header if token isn't empty	2015-09-14 14:49:11 +09:30
Toby Zerner	9def5d2b5d	Clean up	2015-08-06 16:00:22 +09:30
Toby Zerner	32648147e2	Reload page on login ... closes flarum/core#145	2015-08-06 15:04:20 +09:30
Toby Zerner	76678f72f2	Case-sensitive filename changes	2015-07-15 15:54:34 +09:30