arxiv/arxiv-auth

Login page and core auth library

arxiv-auth's Issues

Check expiry time on session cookie

Should log out automatically after XX period (30 minutes?)

Use-case: General API consumer

As a web developer, I should be able to obtain access to arXiv’s APIs, e.g. by requesting authorization credentials and/or tokens. I should be able to programmatically query published arXiv papers and retrieve public procedural and descriptive metadata about them. In cases in which I need privileged access to arXiv resources, I should be able to request privilege escalation and receive consideration in a timely manner. Where appropriate, I should be able to obtain direct authorization from an end-user to take action on their behalf, e.g. to submit or update a paper on arXiv.

Mark required fields on registration form

Asterisk, and line about required fields marked as such.

Vulnerability - private disclosure?

Describe the bug
I've found an open redirect vulnerability in arXiv's authentication page. Is there a way to responsibly disclose it to you in private? If not, are you happy for me to post it in the open here?

Edit registration needs to allow current uname/email

Tried to edit my profile, form throws validation errors for username/email already in existence.

Adjust labels on registration form fields

In particular:
"Organization" -> "Affiliation"
"Status" -> ??? confusing label
"Groups to which..." -> think about this w/r/t how archives and categories are represented elsewhere