- Shipped
- November 15, 2026 at 1:03 AM UTC
- Author
- Kamo
- Commit
- 4af5a37
- Login no longer dumps every request header (cookies included) at DEBUG. *** ids, one-time keys and their Redis keys are logged only as a one-way 8-hex fingerprint (KSessionService.fingerprint); password lengths and password-hash prefixes are no longer logged. - A password reset (recovery, the set-password link) and a password set by a god-eligible caller end EVERY session of the user through the ***UIDX index and revoke every KamoMobile device token. A member's own change keeps the session it was made from and signs out everywhere else; the phone stays paired. Runs after commit and never throws (PasswordChangeSessionRevoker). - POST /register: per public IP (40/h) and per submitted email (5/h) limits in Redis, 429 + Retry-After, logged as REGISTRATION_REJECTED; fails open on a Redis error, logged with the throwable. - EXTERNAL_AUTH_PROVIDERS client secrets: already unreadable (entity @JsonIgnore, Organization collection @JsonIgnore, /providers returns ids only) - now pinned by a test. - The registration code's 5-wrong-tries rule was already on main (2026-09-17); unchanged.