Andy Dixon
89580c0a79
- TOTP second factor (RFC 6238, secret encrypted under the master key), ten hashed single-use recovery codes, two-step login with a pending token bound to the client address, account enrolment/disable, admin reset - tests/security: prompt-injection corpus never acts or creates evidence-free beliefs; roles and CSRF on form and API paths; cross-mind isolation (demo scenario 5); stored-XSS escaping and CSP across pages; secrets never echoed (API, pages, database, archives); hostile archive import; session lifecycle and security headers - OpenAPI 3.1 document generated from the route table, served at /api/v1/openapi.json and kept complete by a test - gosec clean (justified #nosec annotations, cookie/redirect hardening, bounded multipart parsing, UUID packing without narrowing conversions); govulncheck clean with toolchain pinned to go1.26.8 - THREAT_MODEL verification pointers, SECURITY.md testing section, README, CHANGELOG 0.1.0, docs/RELEASE_NOTES.md, PLAN status
15 lines
776 B
HTML
15 lines
776 B
HTML
{{define "content"}}
|
|
<div class="card auth-card">
|
|
<div class="brand big"><span class="brand-mark" aria-hidden="true"></span>Noema</div>
|
|
<p class="muted">Enter the six-digit code from your authenticator app, or one of your recovery codes.</p>
|
|
<form method="post" action="/login/totp" class="stack">
|
|
<input type="hidden" name="_csrf" value="{{.CSRF}}">
|
|
<input type="hidden" name="next" value="{{.Data.Next}}">
|
|
<label>Code <input name="code" inputmode="numeric" autocomplete="one-time-code" required autofocus maxlength="24"></label>
|
|
{{with .Data.Error}}<p class="error" role="alert">{{.}}</p>{{end}}
|
|
<button class="btn btn-primary" type="submit">Continue</button>
|
|
<p class="muted small"><a href="/login">Start over</a></p>
|
|
</form>
|
|
</div>
|
|
{{end}}
|