myron 654aecc2dd Replace cookie auth with URL token auth in admin portal ...

Cookies failed consistently in real browsers despite working in curl.
Replaced with DB-stored token passed as ?_t=TOKEN in URL:
- Login generates 64-char hex token, stores in admin_tokens table
- Redirect to /admin/?_t=TOKEN after successful login
- Every request validated via DB lookup (no cookies needed)
- All 7 AJAX calls include &_t=TOKEN in POST body
- Logout deletes token from DB
- Requires admin_tokens table (created in DB)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-22 18:59:50 +00:00

..

.htaccess

Fix admin login: replace PHP sessions with HMAC cookie auth

2026-05-22 14:15:33 +00:00

index.php

Replace cookie auth with URL token auth in admin portal

2026-05-22 18:59:50 +00:00