diff options
Diffstat (limited to 'AGENTS.md')
| -rw-r--r-- | AGENTS.md | 6 |
1 files changed, 4 insertions, 2 deletions
@@ -7,7 +7,7 @@ the same commit. It is the first thing a future session reads. ## What this is Blogspace: a multi-tenant blog host. One Go binary + Postgres. The base domain -serves the superadmin's own blog plus the management site (`/login`, +serves the superadmin's own blog plus the management site (`/webadmin`, `/dashboard`, `/b/<sub>/…`, `/admin/`); every other blog is served at `<sub>.BASE_DOMAIN`. See `README.md` for the user-facing description, config table and deployment notes. @@ -62,7 +62,9 @@ internal/web/ server.go (host router, middleware, render helpers) (`handlers_pages.go`) and to `TestRootRoutePrecedence`. `/static/{file}` is a single segment on purpose (a `/static/` prefix pattern conflicts with `/{page}/{post}`); static files must stay flat. -- **Auth**: HS256 JWT in `session` cookie (`HttpOnly`, `SameSite=Lax`, +- **Auth**: login lives only at `/webadmin` on the root domain (deliberately + not `/login`, and not linked from public pages); `/webadmin` on a blog host + redirects there with `next=/b/<sub>/`. HS256 JWT in `session` cookie (`HttpOnly`, `SameSite=Lax`, 7 days). Claims carry `uid` + `ver` (= `users.token_version`); the session middleware re-loads the user every request and drops the session if disabled or version mismatch. Password change / reset / disable bump |