MHSanaei bbefe91011 fix(auth): invalidate sessions when 2FA is enabled, fix dev 401 loop ... Add UserService.BumpLoginEpoch and call it from updateSetting when TwoFactorEnable flips false → true. Existing cookies (issued under the looser no-2FA policy) get a 401 on their next request and are forced through the login flow. Disabling 2FA is a relaxation and does not bump the epoch — sessions stay valid. Also fix the dev-mode 401 redirect: targeting `${basePath}login.html` breaks when basePath isn't "/" (Vite has no file at e.g. "/test/login.html"; the SPA fallback loops the 401). Navigate to basePath instead — Vite's bypassMigratedRoute and Go's index handler both serve login.html for that path. Strip stale doc-comment from netsafe and IndexController.logout in line with the project's no-inline-comments convention.		2026-05-13 14:08:16 +02:00
..
config.json	dokodemo-door, socks renamed to mixed, tunnel	2025-09-09 13:57:40 +02:00
custom_geo.go	fix(security): SSRF-guard node and remote HTTP clients	2026-05-13 13:33:53 +02:00
custom_geo_test.go	v3	2026-05-10 02:13:42 +02:00
inbound.go	fix(inbound): require email when adding or updating a client	2026-05-13 13:45:31 +02:00
metric_history.go	feat(panel): xray metrics dashboard with observatory probe history	2026-05-12 02:17:45 +02:00
node.go	fix(security): SSRF-guard node and remote HTTP clients	2026-05-13 13:33:53 +02:00
nord.go	feat(xray/nord): searchable server list + colored load tag, surface API errors	2026-05-11 10:06:01 +02:00
outbound.go	feat(xray/outbounds): TCP probe mode + Test All + timing breakdown	2026-05-11 04:17:23 +02:00
panel.go	Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)	2026-05-13 12:52:52 +02:00
panel_other.go	feat: add panel update functionality via web GUI (#4117)	2026-04-28 18:46:55 +02:00
panel_test.go	feat: add panel update functionality via web GUI (#4117)	2026-04-28 18:46:55 +02:00
panel_unix.go	feat: add panel update functionality via web GUI (#4117)	2026-04-28 18:46:55 +02:00
port_conflict.go	fix(inbounds): scope port check to node and preserve caller tag	2026-05-11 12:51:45 +02:00
port_conflict_test.go	fix(inbounds): scope port check to node and preserve caller tag	2026-05-11 12:51:45 +02:00
server.go	Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)	2026-05-13 12:52:52 +02:00
server_vlessenc_test.go	Feat: clarify VLESS encryption auth selection (#4271)	2026-05-12 11:39:28 +02:00
setting.go	Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)	2026-05-13 12:52:52 +02:00
setting_security_test.go	Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)	2026-05-13 12:52:52 +02:00
tgbot.go	Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)	2026-05-13 12:52:52 +02:00
tgbot_test.go	Implement CSRF protection and security hardening across the application (#4179)	2026-05-07 23:36:11 +02:00
traffic_writer.go	Fix: traffic writer restart freeze (#4265)	2026-05-12 11:36:05 +02:00
traffic_writer_test.go	Fix: traffic writer restart freeze (#4265)	2026-05-12 11:36:05 +02:00
url_safety.go	Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)	2026-05-13 12:52:52 +02:00
user.go	fix(auth): invalidate sessions when 2FA is enabled, fix dev 401 loop	2026-05-13 14:08:16 +02:00
warp.go	v3	2026-05-10 02:13:42 +02:00
websocket.go	v3	2026-05-10 02:13:42 +02:00
xray.go	fix(nodes): bind form-encoded posts and skip node inbounds in central xray	2026-05-10 11:32:06 +02:00
xray_metrics.go	Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)	2026-05-13 12:52:52 +02:00
xray_setting.go	v3	2026-05-10 02:13:42 +02:00
xray_setting_test.go	xray-setting: pin api routing rule to index 0 on save (#4124)	2026-04-28 17:49:39 +02:00