Add comprehensive security and session management features #212

Merged

rwachters merged 27 commits from improve_user_login_security into master

2026-05-10 02:41:43 +00:00

rwachters commented

2026-05-10 02:39:25 +00:00

(Migrated from github.com)

Summary

This pull request introduces a suite of features and changes to enhance security and session management for the authentication system. It includes device-based trust handling, robust session tracking, structured security alerts, and configurable account security modes.

Key Changes

Device Trust and Restricted Sessions
- Add trusted device tracking and restricted session handling.
- Propagate restricted-session state in JWTs, login responses, and session APIs.
- Introduce permission checks for session-based actions from untrusted devices.
Security Audits and Alerts
- Implement a security audit mechanism for suspicious activities like unacknowledged logins.
- Add API endpoints for managing security alerts and acknowledging unrecognized device logins.
Improved Login and Password Management
- Add secure password change and reset flows, enforcing policy-based validation rules.
- Introduce a lockout mechanism for repeated failed login attempts.
Enhanced Session Management
- Add active session management for viewing and revoking user sessions.
- Implement logout-all session functionality and targeted session revocation.
Configurable Authentication Policies
- Introduce dynamic authentication policies for password and username validation.
- Add account security modes (disabled, warning, strict) to control device trust behavior.

Additional Updates

Refactor deprecated DAO methods for improved consistency in server components.
Add IP address tracking for user sessions to enable IP-sensitive security flows.
Include reverse proxy configuration options to support secure deployments.

Checklist

Ensure backward compatibility for existing authentication flows.
Test device trust and security logic under various account security modes.
Validate migration scripts for session and audit schema changes.
Confirm API changes align with current client-side expectations.

### Summary This pull request introduces a suite of features and changes to enhance security and session management for the authentication system. It includes device-based trust handling, robust session tracking, structured security alerts, and configurable account security modes. ### Key Changes - **Device Trust and Restricted Sessions** - Add trusted device tracking and restricted session handling. - Propagate restricted-session state in JWTs, login responses, and session APIs. - Introduce permission checks for session-based actions from untrusted devices. - **Security Audits and Alerts** - Implement a security audit mechanism for suspicious activities like unacknowledged logins. - Add API endpoints for managing security alerts and acknowledging unrecognized device logins. - **Improved Login and Password Management** - Add secure password change and reset flows, enforcing policy-based validation rules. - Introduce a lockout mechanism for repeated failed login attempts. - **Enhanced Session Management** - Add active session management for viewing and revoking user sessions. - Implement logout-all session functionality and targeted session revocation. - **Configurable Authentication Policies** - Introduce dynamic authentication policies for password and username validation. - Add account security modes (disabled, warning, strict) to control device trust behavior. ### Additional Updates - Refactor deprecated DAO methods for improved consistency in server components. - Add IP address tracking for user sessions to enable IP-sensitive security flows. - Include reverse proxy configuration options to support secure deployments. ### Checklist - [ ] Ensure backward compatibility for existing authentication flows. - [ ] Test device trust and security logic under various account security modes. - [ ] Validate migration scripts for session and audit schema changes. - [ ] Confirm API changes align with current client-side expectations.

Rows
Columns