492b1925fb
tests / pest (push) Successful in 7m42s
Details
tests / assets (push) Successful in 21s
Details
tests / release (push) Successful in 6s
Details
Fortify sends every successful sign-in to config('fortify.home') — /dashboard.
That is why an operator signing in ended up in the customer portal, and once
the console has a hostname to itself it stops being merely confusing:
/dashboard does not exist on that host, so signing in would land on a 404.
Three outcomes now, decided by where the sign-in happened and who signed in:
the console for an operator on the console, the portal everywhere else, and for
a non-operator on the console the session is taken away again at the moment it
was created — a guard that merely refuses each page afterwards leaves that
session in the browser.
Four things the review caught, each of which would have left a hole:
- Fortify never reaches LoginResponse when a two-factor challenge was involved.
Binding only that one left exactly the accounts most likely to be operators
on the old behaviour, so both exits are bound and share one decision.
- The JSON branch ran before the authorization check, so a JSON client kept a
session a browser would have lost.
- The two exits do not share a JSON success contract — an ordinary sign-in
answers {"two_factor":false}, a completed challenge answers an empty 204 —
and merging them breaks a client keying off the status code.
- In shared mode everyone posts to /login, so the request never looks like the
console even when /admin is the destination. The intended URL is read too.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| admin.php | ||
| admin_settings.php | ||
| auth.php | ||
| backups.php | ||
| billing.php | ||
| cloud.php | ||
| coming_soon.php | ||
| common.php | ||
| dashboard.php | ||
| datacenters.php | ||
| hosts.php | ||
| impersonate.php | ||
| instances.php | ||
| invoices.php | ||
| maintenance.php | ||
| plans.php | ||
| provisioning.php | ||
| settings.php | ||
| status.php | ||
| support.php | ||
| updating.php | ||
| users.php | ||
| vpn.php | ||