| Age | Commit message (Collapse) | Author |
|---|
|
made them hidden fields in the form. This way a bookmarklet will be
able to read the fields, and authentication can be done without trusting the javascript sent by the server.
I also organized urls.py
|
|
must send the server the password. I wasn't happy about doing this
in plaintext, so I've incorporated slowAES on both the client and the server to encrypt the password before it is sent, using the key generated
in the first SRP transaction.
|
|
login script is now .3 kb smaller, but there is a new 1.1 kb
register file. I think that registrations are rare enough relative to logins that this should be a worthwhile tradeoff. This also prepares a
framework for importing an update file, which will allow existing installations to upgrade from less secure authentication protocols, so some of
the overhead in srp.js that was added here will help reduce the size as we add the update functionality.
|
|
|
|
files. Instead of sending 6 javascript files totaling about 50KB, we
now send 1 file totaling 21.1KB.
After modifying any javascript files, run build-pack.sh to update
srp.min.js.
The login.html and register.html templates have been changed to send
the one packed file. The file srp.js was modified so that it would pack
properly.
Necessary files from the perl version of packer are included, but they
shouldn't be included on production web servers. The packer files are
released under the LGPL.
|
|
Also added a 'key' function to the SRP javascript library, in case anyone wants to use K for encrypting communications.
|
