sign CSRF with cookie, Login rate-limit key hardened against identifier-only lockout

2026-02-07 18:52:00 -08:00
parent fd013de325
commit 70103e18fb
6 changed files with 104 additions and 24 deletions
@@ -76,8 +76,8 @@ export const Settings: React.FC = () => {
            );

            if (response.data.authEnabled) {
-                // Auth enabled -> prompt admin bootstrap via register.
-                window.location.href = '/register';
+                // Auth enabled -> bootstrap registration only when required.
+                window.location.href = response.data.bootstrapRequired ? '/register' : '/login';
                return;
            }