nvrl 947cc2ba96 share: the key never travels in a URL ...

The share page used to put the key in the API path, and every embedded
picture or video carried it in its src, so a reverse proxy's access log
held whole links. The page now sends the key in the body of
POST /api/share/{token}. The answer sets a diary_share cookie
(__Secure- over HTTPS) scoped to /api/share/{token}/, HttpOnly,
SameSite=Strict, good for twelve hours, and signed over the key's hash.
Media is served from /api/share/{token}/media/{id} only to a browser
holding that cookie, so minting a new key or unsharing voids it.

The old /api/share/{token}/{key} routes are gone; links themselves are
unchanged, since the key was always in their fragment.

2026-10-20 12:33:59 +02:00

..

src

share: the key never travels in a URL

2026-10-20 12:33:59 +02:00

bun.lock

markdown: math set by KaTeX, fetched only when a page has some

2026-10-20 10:25:26 +02:00

index.html

redesign

2026-10-17 13:44:05 +02:00

package.json

markdown: math set by KaTeX, fetched only when a page has some

2026-10-20 10:25:26 +02:00

svelte.config.js

Terminal-themed markdown diary

2026-09-05 05:39:25 +02:00

tsconfig.json

Terminal-themed markdown diary

2026-09-05 05:39:25 +02:00

vite.config.ts

markdown: math set by KaTeX, fetched only when a page has some

2026-10-20 10:25:26 +02:00