{# Sign-in. Spare, not unfinished. The distinction is the surface: this screen carries the same bordered panel as every list, empty state and error in the product, so it reads as the same piece of software rather than as a form somebody forgot to place. Nothing here is styled inline; what the stylesheet says is what the server sends. The one thing worth saying is which machine you are about to get root on, because an operator with several servers open in several tabs should not have to guess. So the hostname is mono at full contrast under an eyebrow, not a caption under the logo. #} Sign in - {{ hostname }} - WASM

Sign in to the WASM panel

WASM

Signing in to

{{ hostname }}

{% if error %} {% endif %} {# Posted as a plain urlencoded form to /login, which is what the server parses: a single "token" field, and nothing in the URL, because a query string is written to browser history, proxy logs and access logs. There is no CSRF field, and there deliberately is not one. This exchange happens before any session exists, so there is no token to carry; the field that used to sit here always sent an empty string, which is a claim of protection that was not there. Nothing is at stake either way: the only thing this form can do with a forged submission is present a token the forger already knows. #}
Run wasm web token on the server to print it.
{# Only rendered when the server will actually read it. Showing the field to a machine that does not require a second factor would teach every operator to ignore it, and showing it teaches an attacker nothing: the first wrong token already reveals whether one is required. #} {% if totp_required %}
The 6-digit code from your authenticator app, or a backup code.
{% endif %}
{# Only when the lockout has not already been said above: a refusal repeated twice on one screen reads as two different problems. It carries the busy rail and full-contrast text, because "wait, then try again" is the state of the machine and not a footnote. #} {% if locked_for and not error %}

Too many attempts. Try again in {{ locked_for }} seconds.

{% endif %}

This panel acts as root on this machine.