Public demo. Anyone can sign in with the demo accounts, and all data is deleted every hour. Do not enter real data.
Security
These protections ship with the template. They do not replace a review of your own extensions, but they take care of the groundwork.
Sign-in
- Passwords hashed with scrypt as OWASP recommends (N = 2¹⁷)
- Second factor with TOTP (RFC 6238), keys encrypted with AES-256-GCM
- Ten recovery codes, stored only as hashes, each valid once
- Passkeys instead of the code, bound to this site so a look-alike page cannot use them
- Account lockout after failed attempts, wrong codes count too
Tokens and links
- JWT with a fixed algorithm, issuer, audience and token type
- Refresh tokens work once; reusing one ends every session
- Password reset and email confirmation links work once and expire
- Tokens from email links never appear in a log
Browser
- Content Security Policy without inline scripts or inline styles
- CSRF token in every form, plus a Fetch Metadata check
- Session cookie with HttpOnly, Secure, SameSite=Strict and the __Host- prefix
- HSTS, COOP, COEP, CORP and Permissions-Policy
Input and operations
- Every request is checked against a schema, unknown fields are rejected
- Protection against NoSQL injection and prototype pollution
- Size limits, rate limits and timeouts against slowloris
- Error messages without internal details, with an error ID instead