torsten/harheimertc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement passkey recovery feature, including email link requests and registration options. Update login and registration pages to support passkey authentication, with UI enhancements for user experience. Add server-side handling for passkey registration and login, including account activation checks. Update environment configuration for passkey recovery TTL settings.
Some checks failed
Code Analysis (JS/Vue) / analyze (push) Failing after 48s
Details

Browse Source
This commit is contained in:
Torsten Schulz (local)
2026-01-07 18:37:01 +01:00
parent a8423f9c39
commit fde25d92c5
13 changed files with 843 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
DATENSCHUTZ_UEBERSICHT.md
View File

@@ -166,6 +166,16 @@
- `GET /api/auth/passkeys/list`
- `POST /api/auth/passkeys/remove`
### Passkey-Recovery (E-Mail-Link):
- **Ziel**: Wenn der Passkey verloren geht (neues Gerät/Crash), kann ein neuer Passkey **hinzugefügt** werden.
- **Sicherheitsannahme**: Zugriff auf das E-Mail-Postfach gilt als Recovery-Faktor (Account-Übernahme möglich bei kompromittierter Mailbox).
- **Ablauf**:
- Request: `POST /api/auth/passkeys/recovery/request` (sendet Link; keine Account-Enumeration)
- Options: `GET /api/auth/passkeys/recovery/options?token=...`
- Complete: `POST /api/auth/passkeys/recovery/complete`
- **Eigenschaften**: Token ist kurzlebig (TTL), serverseitig nur gehasht gespeichert, one-time-use, rate-limited, audit-logged.
---
## 🛡️ API-Endpunkte & Zugriffsschutz