Aug 26 - Enhance security

app/static/js/auth.js

@@ -83,7 +83,6 @@ const Auth = (() => {
 
   // Temporarily held between Step 1 and Step 2
   let _pendingMfaToken = null;
-  let _pendingEncKeySalt = null;
   let _pendingPassword = null;
 
   async function handleLogin(e) {
@@ -114,11 +113,11 @@ const Auth = (() => {
       }
 
       if (data.mfa_required) {
-        // Step 2: collect TOTP code
+        // Step 2: collect TOTP code.
+        // enc_key_salt is no longer part of this response — the server withholds
+        // it until the second factor is verified, so it arrives from /mfa/verify.
         _pendingMfaToken = data.mfa_token;
-        _pendingEncKeySalt = data.enc_key_salt;
         _pendingPassword = password;
-        sessionStorage.setItem("enc_key_salt", data.enc_key_salt);
         showMfaStep();
         return;
       }
@@ -183,7 +182,7 @@ const Auth = (() => {
       await completeLogin(_pendingPassword, {
         access_token: data.access_token,
         refresh_token: data.refresh_token,
-        enc_key_salt: _pendingEncKeySalt,
+        enc_key_salt: data.enc_key_salt,
       });
     } catch (err) {
       errEl.textContent = "An unexpected error occurred. Please try again.";
@@ -228,7 +227,6 @@ const Auth = (() => {
     document.getElementById("mfa-code").value = "";
     document.getElementById("mfa-error").classList.add("hidden");
     _pendingMfaToken = null;
-    _pendingEncKeySalt = null;
     _pendingPassword = null;
   }