mirror of
https://github.com/navidrome/navidrome.git
synced 2026-08-01 07:21:17 +00:00
Falls back to validating against the user's active app passwords when the primary password match fails and no JWT is presented. Supports both p= (plaintext / enc:) and t=/s= (token+salt md5) shapes, uses crypto/subtle for constant-time comparison, and updates last_used_at asynchronously after a successful match. Lets Subsonic clients (DSub, play:Sub, Symfonium, Feishin, etc.) authenticate with named per-application secrets instead of the primary account password.