BOHA 33268b38ae fix: TOTP login flow loses remember_me — sessions expire after 1 hour
The TOTP verification endpoint always created refresh tokens with
remember_me=false and 1-hour expiry, regardless of what the user
selected at login.

Fix:
- Frontend now sends remember_me in the TOTP verify request body
- Backend reads remember_me and uses it for token expiry (30 days)
  and cookie maxAge

Users with 2FA who checked "remember me" will now stay logged in
for 30 days instead of being kicked out after 1 hour.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 20:28:54 +01:00
2026-03-23 08:46:51 +01:00
2026-03-23 08:46:51 +01:00
2026-03-23 08:46:51 +01:00
2026-03-23 08:46:51 +01:00
2026-03-23 08:46:51 +01:00
2026-03-23 08:46:51 +01:00
2026-03-23 08:46:51 +01:00
2026-03-23 08:46:51 +01:00
Description
No description provided
16 MiB
v1.5.1 Latest
2026-04-02 20:01:44 +02:00
Languages
TypeScript 94%
CSS 5.9%