Safari-specific deviations fixed:
1. Safari shows its native auth dialog on fetch() calls answered with a
401 + WWW-Authenticate challenge (e.g. save with an expired session).
All CMS 401 responses now omit WWW-Authenticate; browsers use the styled
/login page instead.
2. Safari caches Basic credentials and resends them automatically, which
made logout ineffective (a navigation after logout went straight back
into the editor). Browser navigations (GET + text/html) now authenticate
ONLY via the session cookie; Basic Auth remains valid for non-browser
clients (curl, API).
3. /login and redirects send Cache-Control: no-store so Safari does not
cache the login page or the 302.
Closes MITHOME-62
- logout asks for confirmation, then invalidates the server-side session
and navigates to a public /login page (logo, form, error messages)
- POST /login validates credentials (timing-safe) and issues an HttpOnly
SameSite=Strict session cookie (8h, Secure behind HTTPS); Basic Auth
stays valid in parallel for curl/API use
- unauthenticated browser navigations redirect to /login; non-browser
requests keep the 401 challenge
- failed form logins share the auth rate-limit budget with Basic attempts
- save/publish redirect to /login when the session expired
- refactor: templates and browser script extracted to scripts/cms-pages.js
and scripts/cms-editor-client.js, session logic to scripts/cms-session.js
(content-editor.js back under the 400-line limit)
- user guide updated (login page, confirmation, 8h session)
Closes MITHOME-58
Do Siki