cesnimda
ce76046a29
- consolidate API ownership and remove dead vendor code - add Stripe billing, learning paths, and public CV hardening - add migration, recovery, security, audit, and browser gates
672 B
672 B
overview
Jobjakt supports local email/password sessions plus optional Google and Microsoft identity exchange.
Local access tokens are stored in an HttpOnly jobtracker_session cookie; mutating cookie-authenticated
requests also require the double-submit CSRF token. Identity, sessions, two-factor authentication,
trusted devices, email verification, and password reset are implemented by the controllers and services
under JobTrackerApi/Controllers and JobTrackerApi/Services.
Production authentication fails closed when required configuration is missing. See
docs/architecture/authentication.md and docs/security/authentication.md for the security model.