cesnimda
ce76046a29
- consolidate API ownership and remove dead vendor code - add Stripe billing, learning paths, and public CV hardening - add migration, recovery, security, audit, and browser gates
11 lines
672 B
Markdown
11 lines
672 B
Markdown
# overview
|
|
|
|
Jobjakt supports local email/password sessions plus optional Google and Microsoft identity exchange.
|
|
Local access tokens are stored in an HttpOnly `jobtracker_session` cookie; mutating cookie-authenticated
|
|
requests also require the double-submit CSRF token. Identity, sessions, two-factor authentication,
|
|
trusted devices, email verification, and password reset are implemented by the controllers and services
|
|
under `JobTrackerApi/Controllers` and `JobTrackerApi/Services`.
|
|
|
|
Production authentication fails closed when required configuration is missing. See
|
|
`docs/architecture/authentication.md` and `docs/security/authentication.md` for the security model.
|