Chronoverse uses browser-oriented session authentication rather than exposing service JWTs to public clients.
Register
POST /auth/register accepts email and password, creates the user, and issues session and CSRF cookies. Emails are trimmed and lowercased; registration passwords need 8–72 characters with a zxcvbn score of at least 3 and must not match the bundled common-password dictionary.
Login
POST /auth/login validates credentials and issues fresh cookies.
Invalid credentials return the same 401 Unauthorized response whether or not the email is registered.
Validate
POST /auth/validate verifies the current session and CSRF state. It is useful for dashboard session bootstrap.
Logout
POST /auth/logout removes both cookies and returns 204 No Content.
Internal authorization
The HTTP gateway signs authorization metadata for downstream gRPC services using Ed25519 keys. Service clients also use mTLS in the Compose topology.
Cookie deployment settings
SERVER_HOST_URL, SERVER_ALLOWED_ORIGINS, SERVER_SAME_SITE_MODE, session expiry, CSRF expiry, and the CSRF HMAC secret must match the public deployment origin.