MarSeventh baca53a631 security: upgrade password hashing to PBKDF2 and fix API token generation ...

- Replace single-round SHA-256 with PBKDF2 (100k iterations) via Web Crypto API
- Auto-rehash old SHA-256/plaintext passwords to PBKDF2 on successful login
- Add timing-safe comparison to prevent timing attacks
- Replace Math.random() with crypto.getRandomValues() for API token and token ID generation
- Maintain full backward compatibility with existing SHA-256 hashes and plaintext passwords

2026-04-18 00:45:04 +08:00

..

login.js

security: upgrade password hashing to PBKDF2 and fix API token generation

2026-04-18 00:45:04 +08:00

logout.js

refactor: move auth endpoints to /api/auth/ subdirectory

2026-04-17 23:46:24 +08:00

resetAuth.js

refactor: move auth endpoints to /api/auth/ subdirectory

2026-04-17 23:46:24 +08:00

sessionCheck.js

refactor: move auth endpoints to /api/auth/ subdirectory

2026-04-17 23:46:24 +08:00