Sign in - {{ hostname }}

WASM

{% if error %}

{% endif %} {# Posted as a plain urlencoded form to /login, which is what the server parses: a single "token" field, and nothing in the URL, because a query string is written to browser history, proxy logs and access logs. There is no CSRF field, and there deliberately is not one. This exchange happens before any session exists, so there is no token to carry; the field that used to sit here always sent an empty string, which is a claim of protection that was not there. Nothing is at stake either way: the only thing this form can do with a forged submission is present a token the forger already knows. #} {# Only when the lockout has not already been said above: a refusal repeated twice on one screen reads as two different problems. #} {% if locked_for and not error %}

Too many attempts. Try again in {{ locked_for }} seconds.

{% endif %}