MHSanaei 42e2a91b92 fix(auth): invalidate other sessions when credentials change ... When the admin changes username/password from one machine, sessions on every other machine kept working until they manually logged out because session storage is a signed client-side cookie — there is no server-side session list to revoke. Add a per-user LoginEpoch counter stamped into the session at login and re-verified on every authenticated request. UpdateUser and UpdateFirstUser bump the epoch (UpdateUser via gorm.Expr so a single update statement is atomic), so any cookie issued before the change no longer matches the user's current epoch and GetLoginUser returns nil — the SPA's 401 interceptor then redirects to the login page. Backward compatible: the column defaults to 0 and missing cookie values are treated as 0, so sessions issued before this change remain valid until the first credential update.		2026-05-13 12:48:13 +02:00
..
csrf.go	Implement CSRF protection and security hardening across the application (#4179)	2026-05-07 23:36:11 +02:00
session.go	fix(auth): invalidate other sessions when credentials change	2026-05-13 12:48:13 +02:00
session_test.go	refactor(session): store user ID in session instead of full struct	2026-05-11 21:16:22 +02:00