Jakub Zych 07196a4bcb fix: keep the device polling token off the QR code ...

golem15.user.device_auth.auth_url gains a {short_code} placeholder and
defaults to {frontend_url}/device/scan/{short_code}; POST
/devices/authorize accepts the short code in its token field, so a scan
page that posts what its URL carries keeps working. The status poll hands
the session token over only to a client with the User-Agent the device
initiated with; another client sees the session confirmed and takes
nothing.

2026-10-26 16:12:08 +01:00

7.4 KiB

Raw Blame History

View Raw