André Duffeck 10b93edded Derive the guest session key from OC_JWT_SECRET ...

Replace AUTH_GUEST_SESSION_JWT_SECRET with a key derived via
HMAC-SHA256 from the reva JWT secret. Guest session tokens and reva
access tokens remain unforgeable across each other without a second
secret to configure.

2026-10-07 08:46:53 +02:00

..

command

Derive the guest session key from OC_JWT_SECRET

2026-10-07 08:46:53 +02:00

config

Derive the guest session key from OC_JWT_SECRET

2026-10-07 08:46:53 +02:00

metrics

feat(guestauth): guestauth service rename to auth-guest

2026-10-06 08:07:44 +02:00

revaconfig

Derive the guest session key from OC_JWT_SECRET

2026-10-07 08:46:53 +02:00

server

Limit body size on unauthenticated redeem endpoint

2026-10-06 09:52:02 +02:00

service

Use subtle to compare the hash

2026-10-06 09:52:02 +02:00