Method sessionLogin

apps/server/internal/httpserver/security.go:454–486

(w http.ResponseWriter, r *http.Request)

}

func (s *Server) sessionLogin(w http.ResponseWriter, r *http.Request) {
	cfg := s.currentConfig()
	if !s.loginLimiter.allow(s.clientAddressKey(r)) {
		http.Error(w, "too many login attempts", http.StatusTooManyRequests)
		return
	}

	if strings.TrimSpace(cfg.AuthToken) == "" {
		writeJSON(w, http.StatusOK, sessionStatusPayload(true, cfg))
		return
	}

	var req struct {
		Token string `json:"token"`
	}
	if err := readJSON(r, &req); err != nil {
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}
	if subtleCompare(strings.TrimSpace(req.Token), strings.TrimSpace(cfg.AuthToken)) {
		s.loginLimiter.reset(s.clientAddressKey(r))
		token, expiresAt, err := s.sessions.create()
		if err != nil {
			writeError(w, err)
			return
		}
		http.SetCookie(w, s.sessionCookie(r, token, expiresAt))
		writeJSON(w, http.StatusOK, sessionStatusPayload(true, cfg))
		return
	}

	http.Error(w, "unauthorized", http.StatusUnauthorized)
}

func (s *Server) sessionLogout(w http.ResponseWriter, r *http.Request) {
	if cookie, err := r.Cookie(sessionCookieName); err == nil {