[Airsonic] Login/Password (11)

[tesshucom]

Problem description

This issue was ported from the Airsonic archive. The top node for these issues is #1725.

It does not necessarily aim to solve all problems. However, some points of view will be fed back as Jpsonic is improved in the future.

It also includes issues that have already been resolved by Jpsonic at this stage. These will be progressively organized by topic.

System information

• Jpsonic version: since v111.5.4

New task is issued

• TODO
  • Passwords Stored Insecurely  airsonic/airsonic#69
  • MD5 token recommendation airsonic/airsonic#1099
    • -> Add option to change password precision #1826
• Request
  • Make username case insensitive airsonic/airsonic#676
    • -> Fix to ignore username case #1827
  • Denial of service via password recovery mecanism airsonic/airsonic#935
    • -> Improve password recovery mechanisms #1828
  • Provide a self-hosted captcha airsonic/airsonic#997
    • -> Provide a self-hosted captcha #1829
• Bugs
  • Refresh auth token after changing permissions airsonic/airsonic#1066
  • -> Refresh auth token after changing permissions #1831
  • Password reset procedure sends email with password in clear text airsonic/airsonic#1396
  • -> Fix password reset notification content #1832

Closed

Tracking of the following agenda is closed.

• Auto login for guest airsonic/airsonic#1159
  • It's a use case that's not generally expected, so implementation of this feature is not planned.
    • On the other hand, don't forget that there are people who don't want to let you do that.
  • Secure was mentioned as one of Airsonic's project policies, and Jpsonic's stance remains the same.
  • With the current specification, you could do something similar by creating a user with fewer privileges. It should be done at your own risk.
• Auto-login as admin / single-user mode airsonic/airsonic#1955
  • Since "Remember Me" is implemented in Airsonic, I think it is possible to do something close to so-called Auto Login on modern browsers. Depending on the browser, automatic input may be realized by a function such as "remember this password".
• Remember me doesn't remember or stay logged in after browser closes airsonic/airsonic#1765
  • In Jpsonic, "Remember Me" is suppressed by default(Unfortunately, not all users use VPNs.).
  • You can enable it from the settings screen. This is not optional per user. Only admin can change the policy. It is up to the administrator to allow users to use this feature or not.
  • Similarly, there are some features that are disabled by default. Please confirm.
• Cannot login with default admin/admin username and password airsonic/airsonic#1782
  • It's unclear from the information presented, but it doesn't appear to be a login issue. It may be a pattern that redirects with a path error due to server settings. Check standalone behavior.