summaryrefslogtreecommitdiffstats
path: root/roseh.moe.go
AgeCommit message (Collapse)AuthorFilesLines
2026-02-06Do a little less sha256Rose Hogenson1-6/+4
Since oae2 will internally also call hkdf, there's no reason to hkdf the encryption key twice. We can hkdf it once for the primary key, and then let oae2 hkdf it again for the encryption key. Since the second hkdf uses a 32 byte random salt, the two calls will certainly use different parameters.
2026-02-06Keep redirect query param on incorrect passwordRose Hogenson1-7/+3
This makes it a little less weird when you enter an incorrect password and the URL changes.
2026-01-26Bump depsRose Hogenson1-2/+2
2026-01-21XML!!!Rose Hogenson1-20/+35
2026-01-03Support range requests for wormhole downloadsRose Hogenson1-14/+19
2025-12-29Fix error messagesRose Hogenson1-3/+10
2025-12-29Content-LengthRose Hogenson1-0/+12
2025-12-29Fix clean holeRose Hogenson1-31/+34
2025-12-29Distinguish no holeRose Hogenson1-1/+5
2025-12-29Make wormhole a little bit simplerRose Hogenson1-83/+144
2025-12-27Add Google AuthenticatorRose Hogenson1-10/+32
2025-12-07Use /pkg pathRose Hogenson1-1/+1
2025-12-07Increase target security to 32 bytesRose Hogenson1-7/+5
2025-11-30Use built-in cross-origin protectionRose Hogenson1-58/+20
2025-11-25Use a short cookie nameRose Hogenson1-1/+1
2025-11-21Slightly simplify the int encodingRose Hogenson1-14/+4
2025-11-21Separate MAC by domainRose Hogenson1-25/+18
2025-11-21Simplify the password hash and get rid of pbkdf2Rose Hogenson1-5/+6
Since the password already has 16 bytes of security, pbkdf2 isn't necessary here. We can use a simple sha256. I promise to pick a secure password.
2025-11-21Use a weird encoding for the time.TimeRose Hogenson1-14/+47
This way we can save 19 whole bytes per request 😲
2025-11-15Remove debugRose Hogenson1-2/+1
2025-11-15Fix cookie names and domainRose Hogenson1-6/+11
2025-11-15DebugRose Hogenson1-1/+2
2025-11-15Fix typoRose Hogenson1-1/+1
2025-11-15Preserve redirect path on errorRose Hogenson1-1/+2
2025-11-15Fix cross-domain loginRose Hogenson1-5/+9
2025-11-15Protect the reverse proxy with my hand-rolled authRose Hogenson1-46/+79
Defense in depth??
2025-11-10Validate the QR codeRose Hogenson1-5/+19
Since the qr code is generated by a 3rd party dependency that I probably won't update, let's make sure to only pass it trusted input.
2025-11-10IP?Rose Hogenson1-1/+1
2025-11-10Fix jellyfin portRose Hogenson1-1/+1
2025-11-10Get the credentials directory from a flagRose Hogenson1-3/+3
2025-11-10Add back jellyfin proxyRose Hogenson1-1/+18
We don't need no stupid nginx
2025-11-02Fix a panicRose Hogenson1-1/+4
2025-11-02Improve the upload success screenRose Hogenson1-1/+9
2025-11-02Add QR codeRose Hogenson1-0/+12
2025-11-02Remove server sent eventsRose Hogenson1-68/+47
2025-10-28Switch to cclRose Hogenson1-18/+11
2025-10-25Fix service configRose Hogenson1-4/+10
2025-10-25asspb fixesRose Hogenson1-12/+6
2025-10-25Use asspb instead of iniRose Hogenson1-39/+30
2025-10-14Revert "Remove CSRF tokens"Rose Hogenson1-32/+76
This reverts commit 21d7462b057838eb173145d79d2b9fd6c71e8053. This was a great idea, but tanjiro is still on Go 1.24
2025-10-14Remove CSRF tokensRose Hogenson1-76/+32
I think the built-in cross-origin protection will be good enough.
2025-10-08Validate that secrets were loadedRose Hogenson1-0/+6
2025-10-08Fix typoRose Hogenson1-1/+1
2025-10-07Use ini for the secrets file as wellRose Hogenson1-43/+29
2025-10-07LogRose Hogenson1-0/+1
2025-10-07Use an INI file for configRose Hogenson1-23/+91
2025-10-07Make redirects configurableRose Hogenson1-15/+27
2025-10-07AGPL and some cleanupRose Hogenson1-2/+14
2025-10-07Fix vanity URL (again)Rose Hogenson1-1/+18
2025-10-07Remove unnecessary package redirectionRose Hogenson1-17/+0
generated by cgit v1.3.1 (git 2.54.0) at 2026-09-04 17:24:50 +0000