xTr1m/GameList
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Migrate current password hashing to Argon2id

Browse Source
This commit is contained in:
Frank Tovar
2026-02-18 21:06:22 +01:00
parent a130cba41a
commit e55a1b01f4
9 changed files with 46 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
API.md
View File

@@ -58,4 +58,4 @@ Owner restrictions: owner role/admin status cannot be changed, and owner account
- CSP is tightened to disallow inline styles and insecure image origins (`img-src` excludes `http:`).
- In production, HTTPS redirection and HSTS are enabled.
- Screenshot URL validation rejects private/reserved address ranges and pins outbound connections to validated public IPs.
- Password hashing is versioned; legacy hashes are transparently upgraded on successful login/admin password confirmation.
- Password hashing is versioned with Argon2id as current; legacy hashes are transparently upgraded on successful login/admin password confirmation.