Changed sign-up flow to require e-mail verification up front, preventing account existence leakage.

2026-07-23 22:12:33 +02:00
parent 18c30b6f98
commit 6b3866a99f
12 changed files with 387 additions and 79 deletions
--- a/config/default.cjs
+++ b/config/default.cjs
@@ -161,6 +161,7 @@ module.exports = {
 		tokenCooldown: 10, // minutes, how often a token can be requested
 		emailTokenExpiry: 120, // minutes
 		passwordTokenExpiry: 120, // minutes
+		signupTokenExpiry: 120, // minutes
 	},
 	bans: {
 		defaultExpiry: 60 * 24 * 3, // in minutes, 3 days