Skip to content

fix: hand off setup sign-in via POST body, not URL token #66

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
andregoepel merged 1 commit into from
Jul 4, 2026
Merged

fix: hand off setup sign-in via POST body, not URL token #66

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 11 additions & 2 deletions src/AndreGoepel.AppFoundation/Components/Pages/Setup.razor
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,13 +79,16 @@
</RadzenStack>
</RadzenTemplateForm>

<SignInHandoff Action="/login" Handle="@_handle" />

<RadzenText TextStyle="TextStyle.Caption" Style="color: var(--rz-text-secondary-color);">
This step is only shown once.
</RadzenText>

@code {
private InputModel Input { get; set; } = new();
private bool isProcessing;
private string? _handle;

private int MinPasswordLength => IdentityOptions.Value.Password.RequiredLength;

Expand Down Expand Up @@ -184,13 +187,19 @@

if (signingResult == SignInResult.Success)
{
var token = LoginTokens.Protect(new LoginInfo(model.Email, model.Password, RememberMe: false));
NotificationService.Notify(
NotificationSeverity.Success,
"Success",
"Administrator account created. You are now signed in."
);
NavigationManager.NavigateTo($"/login?token={Uri.EscapeDataString(token)}", forceLoad: true);

// Hand the single-use login handle to the cookie-sign-in middleware.
// SignInHandoff renders a hidden form and POSTs the handle in the request
// body — it never travels in the URL, where it would otherwise leak into
// access logs, browser history, and Referer headers (#50).
_handle = LoginTokens.Protect(
new LoginInfo(model.Email, model.Password, RememberMe: false)
);
}
else
{
Expand Down
Loading