4c040f2c58
- Add sessions table to store session tokens with expiration - Create Session domain model and SessionRepository trait - Implement SqlSessionRepository for session persistence - Update is_authenticated() to validate tokens against database - Sessions expire after 30 days - Session tokens hashed with SHA-256 before storage - Delete sessions from database on logout - Update all page handlers to properly validate sessions This prevents session hijacking by ensuring only valid, unexpired tokens stored in the database can authenticate requests. Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>
13 lines
541 B
SQL
13 lines
541 B
SQL
-- Add sessions table for web authentication
|
|
CREATE TABLE IF NOT EXISTS sessions (
|
|
id TEXT PRIMARY KEY NOT NULL,
|
|
user_id TEXT NOT NULL,
|
|
session_token_hash TEXT NOT NULL,
|
|
created_at TEXT NOT NULL,
|
|
expires_at TEXT NOT NULL,
|
|
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_sessions_token_hash ON sessions(session_token_hash);
|
|
CREATE INDEX IF NOT EXISTS idx_sessions_user_id ON sessions(user_id);
|
|
CREATE INDEX IF NOT EXISTS idx_sessions_expires_at ON sessions(expires_at);
|