[Feature] Improve authentication and session management

[AmanatAliPanhwer]

🌟 Summary

Enhance the security and robustness of the user authentication and session management system.

🧩 Problem or Motivation

The current authentication system is basic. It could be improved with more modern security practices to protect the admin account.

🧰 Proposed Solution

• Password Hashing: Ensure strong password hashing is used (e.g., Argon2 or scrypt) instead of plain text or weaker algorithms.
• Session Management:
  • Use server-side sessions with secure, HTTP-only cookies.
  • Implement session timeout and re-authentication for sensitive actions.
  • Add protection against session fixation and CSRF attacks (e.g., using Flask-WTF or a similar library).
• "Remember Me" Token:
  • If the "Remember Me" functionality is kept, ensure the tokens are stored securely (hashed) and have a limited lifespan.
  • Implement a mechanism to invalidate all "Remember Me" tokens on password change.
• Rate Limiting: Add rate limiting to the login route to prevent brute-force attacks.

📦 Technical Considerations

• Frontend changes (HTML/JS/CSS)
• Backend changes (Flask, Supabase)
• Database changes
• Authentication/Authorization
• UI/UX improvements

🧠 Alternatives

We could integrate a third-party authentication provider, but for a single-admin blog, improving the existing system is likely sufficient.

🧾 Additional Context

These changes are critical for securing the administrator account and protecting the blog from unauthorized access.