lebaudantoine 7da99f2116 🔐(backend) avoids revealing the inactive status of an application ...

Authenticate the application secret before checking whether the
application is inactive.

This avoids revealing the inactive status of an application when
an incorrect secret is provided, preventing an authentication
state oracle and client_id enumeration.

2026-03-12 13:40:11 +01:00

..

__init__.py

✨(backend) introduce an external API router

2025-10-06 19:34:24 +02:00

authentication.py

♻️(backend) align Application model field with is_active convention

2026-03-12 13:26:37 +01:00

permissions.py

♻️(backend) rework permission to better align with DRF responsibilities

2026-02-09 12:16:12 +01:00

serializers.py

✨(backend) draft initial Room viewset for external applications

2025-10-06 19:34:24 +02:00

viewsets.py

🔐(backend) avoids revealing the inactive status of an application

2026-03-12 13:40:11 +01:00