Security
Everything on this page lives under Settings → Security and applies to your own account. Neither two-factor authentication nor a passkey is on by default; both are worth five minutes on an instance that is reachable from the internet.
These are two different trades, and it helps to see them as such before choosing.
Two-factor authentication (TOTP)
Section titled “Two-factor authentication (TOTP)”A second factor on top of the password. You scan a QR code into an authenticator app (any TOTP app works), confirm one six-digit code, and from then on the login asks for the password and then for the current code.
When you turn it on, TravStats shows a set of single-use recovery codes. Store them somewhere that is not the phone: each one lets you in once, without the authenticator, and is then spent. Set two-factor up again after using one, so you have a fresh set.
What it protects against: a leaked or guessed password. What it does not: a device that is already signed in — sessions are not re-asked — and a lost phone without the codes, which is where the administrator comes in.
An account with two-factor on answers a correct password with “now finish signing in”; the session is issued only after the code. That step comes before any forced password change, so an account with both a pending password change and a second factor cannot be taken over on the password alone. A deactivated account is refused at the same gate.
Passkeys
Section titled “Passkeys”A passkey replaces the password and satisfies two-factor by itself: signing in with one issues the session directly and never asks for a TOTP code. That is only sound because both the registration and the sign-in ceremony demand user verification — the assertion proves possession of the credential plus a local gesture (a fingerprint, a face, a device PIN). A passkey is not a weaker login; it is a stronger one that happens to be shorter.
Sign-in is username-less on purpose: the login page offers Sign in with a passkey and the browser or your password manager offers the credential it holds for this instance. That is what lets a syncing password manager work across your devices. You may register several — phone, laptop, hardware key — and name, rename or remove each one under Security.
What the instance needs
Section titled “What the instance needs”A credential is bound to one relying-party id forever, so the rpId
is an explicit admin setting, never guessed from the host header —
a guess from whichever origin happened to arrive would mint passkeys
that stop working the day the address changes. Origins are a list,
because several may share one rpId (a hostname with and without
www). Two things are not valid: a bare IP address is not an
rpId, and plain http outside localhost is not a secure context at
all. The security section explains which one applies instead of
drawing a button that always fails, and the login page checks the
browser’s own secure-context flag too — the server only knows its
configured origins, and an instance reached over a plain-http LAN
address would otherwise show a button the browser can never honour.
If you run TravStats behind a reverse proxy, this is the feature that makes HTTPS worth the twenty minutes; see Reverse proxy.
Which one, or both
Section titled “Which one, or both”| You want | Choose |
|---|---|
| A password you know, plus a code from a phone | Two-factor |
| No password to type, the device proves it is you | A passkey |
| Both a passkey on the phone and a password login elsewhere | Both — a passkey sign-in skips the code; a password sign-in asks for it |
A passkey does not turn two-factor off. If you keep a password login alongside, keep the second factor on it.
When you are locked out
Section titled “When you are locked out”- Lost the authenticator, have a recovery code — use the code where the six digits are asked for, then set two-factor up again.
- Lost both, have a passkey elsewhere — sign in with the passkey and reset two-factor under Security.
- Lost everything — an administrator resets your second factor under Admin → Users → Reset two-factor. That clears the TOTP secret and any pending one; you sign in with the password alone and set it up again. Passkeys are not touched by that reset; you remove those yourself. If you are the only administrator, see the troubleshooting entry.
Sessions, tokens and devices
Section titled “Sessions, tokens and devices”The session is an HttpOnly cookie, never a token in browser
storage; every /api response is Cache-Control: no-store by default,
so a shared cache cannot serve your response to someone else.
Personal Access Tokens are a
separate credential with their own scope and cannot mint, list or
revoke tokens. A paired Companion device holds a device-bound token you
can sign out under Devices. Rate limits count per user, not per
address, so a household behind one proxy does not share a bucket.
What it does not do
Section titled “What it does not do”- No enforced two-factor for everyone. An administrator cannot require it instance-wide; it is a per-account choice.
- No SMS or e-mail codes. TOTP and passkeys only.
- No session list. You cannot see or end other browser sessions from Security; changing the password does not sign the others out.
- No hardware-key attestation policy. Any authenticator the browser accepts is accepted.