Prevent cross-address login lockouts (Refs #63)

2026-10-17 10:55:28 -04:00
parent f3b9699317
commit 4501eba873
14 changed files with 922 additions and 61 deletions
@@ -1,9 +1,19 @@
 import type { RequestHandler } from './$types';
 import { authenticatePassword, revokeSession } from '$lib/server/auth/index.js';
-import { authBody, authError, sessionCookie, sessionResponse } from '$lib/server/auth/http.js';
+import {
+    authBody,
+    authError,
+    loginDeviceCookie,
+    sessionCookie,
+    sessionResponse
+} from '$lib/server/auth/http.js';
 export const POST: RequestHandler = async ({ request, cookies, url, getClientAddress }) => {
    try {
-        const result = await authenticatePassword(await authBody(request), getClientAddress());
+        const result = await authenticatePassword(
+            await authBody(request),
+            getClientAddress(),
+            cookies.get(loginDeviceCookie(url))
+        );
        revokeSession(cookies.get(sessionCookie(url)));
        return sessionResponse(result, cookies, url);
    } catch (cause) {