From 3073532f723b976a2f54666f779e9a045bacb7f6 Mon Sep 17 00:00:00 2001 From: grm Date: Sat, 12 Sep 2026 12:15:47 +0300 Subject: Rename /login to /webadmin and reach it from every blog The login URL is less guessable, bloggers can type /webadmin on their own blog and get bounced to the root login page (and back to their dashboard after logging in), and the public root blog no longer advertises the admin entry point in its footer. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A --- AGENTS.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'AGENTS.md') diff --git a/AGENTS.md b/AGENTS.md index 9c45974..cfe3d06 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -7,7 +7,7 @@ the same commit. It is the first thing a future session reads. ## What this is Blogspace: a multi-tenant blog host. One Go binary + Postgres. The base domain -serves the superadmin's own blog plus the management site (`/login`, +serves the superadmin's own blog plus the management site (`/webadmin`, `/dashboard`, `/b//…`, `/admin/`); every other blog is served at `.BASE_DOMAIN`. See `README.md` for the user-facing description, config table and deployment notes. @@ -62,7 +62,9 @@ internal/web/ server.go (host router, middleware, render helpers) (`handlers_pages.go`) and to `TestRootRoutePrecedence`. `/static/{file}` is a single segment on purpose (a `/static/` prefix pattern conflicts with `/{page}/{post}`); static files must stay flat. -- **Auth**: HS256 JWT in `session` cookie (`HttpOnly`, `SameSite=Lax`, +- **Auth**: login lives only at `/webadmin` on the root domain (deliberately + not `/login`, and not linked from public pages); `/webadmin` on a blog host + redirects there with `next=/b//`. HS256 JWT in `session` cookie (`HttpOnly`, `SameSite=Lax`, 7 days). Claims carry `uid` + `ver` (= `users.token_version`); the session middleware re-loads the user every request and drops the session if disabled or version mismatch. Password change / reset / disable bump -- cgit v1.2.3