CyberMind-FR b50387a06b fix(auth): record client IP + user-agent on the MFA login paths ... /login/mfa and /totp/confirm both hardcoded "ip": "" and omitted user_agent entirely, while only the password path captured them. admin is forced-TOTP, so EVERY real admin login took the MFA path — every session row landed unauditable (who logged in, from where, with what), and the users webui sessions tab rendered blanks for data it was already asking for. Factor the extraction into _client_meta(request) (X-Forwarded-For first: nginx and HAProxy front every login, so request.client.host is only ever the proxy) and use it on all three paths. Verified by driving the real /login/mfa handler in-process with SECUBOX_AUTH_SESSIONS pointed at a temp file: the session row now records ip=192.168.1.77 (the first XFF hop, not the proxy) and the full user-agent. Co-Authored-By: Gerald KERMA <devel@cybermind.fr>		2026-07-17 10:35:07 +02:00
..
routers
__init__.py
main.py	fix(auth): record client IP + user-agent on the MFA login paths	2026-07-17 10:35:07 +02:00
ntp_health.py
totp_pending.py