GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1
Bifrost/src/Bifrost.Web
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Meta Vens d695674359 Heimdall sign-in: redact the app secret from client logging, expire the attempt cookie at its path, bound the return path 
- The HeimdallAuthService client redacts x-heimdall-app-secret from HTTP client logging at every level; a Trace canary test pins it.
- The attempt cookie's deletion carries its Path and no Max-Age (which outranks the 1970 expiry); pinned on success and refusal paths.
- LocalReturnPath is at most 256 characters, else /App, so the attempt cookie stays far below the browser limit; pinned at the bound and with the heaviest-escaping path.
- A set BaseUrl with a blank AppSlug is refused at Start before any Heimdall call; behavioural test.

Builds untested until the verification job at the end of this batch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-11 08:58:19 +02:00
..
Configuration Heimdall sign-in: the attempt is a cookie, and a code the browser presents is redeemed at Heimdall 2026-10-11 04:40:47 +02:00
Data Migration AddConceptVotes, generated by dotnet-ef 8.0.0 2026-10-10 06:39:59 +02:00
Domain Concept votes: subjects, appraisals, voter identity, network tag and their one writer 2026-10-10 06:31:43 +02:00
Features Heimdall sign-in: redact the app secret from client logging, expire the attempt cookie at its path, bound the return path 2026-10-11 08:58:19 +02:00
Pages Vote page: explicit no-store (the antiforgery write no longer supplies it), handler must match the request, empty Origin counts as present 2026-10-11 00:15:13 +02:00
Properties Initial Scaffold 2026-04-21 20:08:49 +01:00
wwwroot Add Bifrost profile avatar 2026-05-20 18:13:53 +01:00
appsettings.Development.json Implement alpha foundation workflow and GitHub sync 2026-04-22 09:50:31 +01:00
appsettings.json Heimdall sign-in: the attempt is a cookie, and a code the browser presents is redeemed at Heimdall 2026-10-11 04:40:47 +02:00
Bifrost.Web.csproj Heimdall sign-in: accept only a Heimdall-signed token for an attempt Start issued, in the browser that started it 2026-10-11 02:54:13 +02:00
Program.cs Heimdall sign-in: redact the app secret from client logging, expire the attempt cookie at its path, bound the return path 2026-10-11 08:58:19 +02:00