Only the direct dependencies were pinned. Werkzeug, Jinja2, MarkupSafe,
itsdangerous and the other transitive packages were resolved at build
time, so builds of the same commit could differ, and pip did not verify
the downloaded files. There was also no vulnerability scan.
- requirements.in / requirements-dev.in list the direct dependencies.
requirements.txt / requirements-dev.txt are lockfiles generated by
pip-compile with exact versions and hashes for every package. The dev
lockfile is constrained by the production one.
- Makefile targets: lock-deps, update-deps, sync-deps and audit
(pip-audit against requirements.txt).
- The locked production versions match the previously installed ones.
The first audit found no known vulnerabilities.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The app set no security headers at all, and the reverse proxy sets none
either.
- Content-Security-Policy: default-src 'none' with 'self' only for
styles, images and fonts (MAX has no JavaScript), form-action 'self'
(also blocks the http:// form action downgrade), frame-ancestors
'none' and base-uri 'none'.
- X-Frame-Options: DENY, X-Content-Type-Options: nosniff,
Referrer-Policy: same-origin.
- Strict-Transport-Security with max-age of 7 days, not in debug mode.
The headers are set in after_request, so they also apply to static
files, 404 and error responses.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The app ran as root, and the production image contained gcc, vim, wget
and gnupg. Code execution in the container would have allowed changing
the app code and fetching or compiling further tools.
- Multi-stage build: the wheels (psycopg2) are built in a build stage.
The runtime image only contains libpq5, postgresql-client and
wait-for-it (724 MB -> 298 MB).
- The app runs as the system user max (uid/gid 10001). The code is
owned by root and precompiled, the user has no writable directory.
- Log to stdout only; docker collects it. The log file under /app/log
was lost on every container recreation anyway.
- docker-compose: read-only filesystem (tmpfs for /tmp), no
capabilities, no-new-privileges and log rotation (5 x 10 MB).
- Add a .dockerignore and set MAX_ORIGIN in docker-compose.yml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
remove_user_sessions() got the user id as except_id, so the exception
never matched. On an own password change the result was correct only
by accident. When an admin changed another user's password, the admin
session got a new id, but the old entry stayed valid in the store.
- New Session.regenerate(): keeps the data under a new id and removes
the old store entry.
- change_password() handles the sessions: on an own password change it
regenerates the current session and ends all other sessions of the
user (except_id is now the session id). When an admin changes another
user's password, the admin session stays untouched and all sessions
of that user end.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The own SessionInterface ignored SESSION_COOKIE_SAMESITE, so the cookie
was sent with every cross-site request in Firefox and Safari (CSRF,
clickjacking in iframes, keeping the idle timeout alive). The cookie
name "session" could also be set by other subdomains or via plain HTTP,
the precondition for session fixation.
- SameSite=Lax. No GET changes state, so links from mails keep working.
- In production the cookie is named __Host-session, which browsers only
accept with Secure, Path=/ and without Domain. The debug server keeps
"session", since it runs without Secure.
- set_cookie and delete_cookie use the same attributes, since browsers
ignore the deletion of a __Host- cookie without Secure.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The session store held at most 100 sessions and evicted the least
recently used one. Anyone with an account could log in 101 times and
thereby log out every other user, including the admins.
- Each user has at most 10 sessions. A new login above the limit
removes the user's own least recently used session (by _last_seen).
- There is no global limit anymore: the store only accepts sessions
with a user_id (raises SessionWithoutUser otherwise), so it is
bounded by 10 * number of users. Anonymous users still create no
store entries.
- save_session clears an invalid session before re-raising, since
Flask saves the session again for the error response.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
If the email or domain field was missing or invalid, the error was
flashed, but the address was still built from the unset attributes,
which raised an AttributeError. Only build and validate the address
if both are set.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Any user could create aliases like postmaster@, webmaster@ or abuse@ on
their domain. CAs use these addresses to validate domains, so a family
account (or a compromised one) could obtain TLS certificates or catch
abuse and system mails.
- Only admins may create aliases with a reserved local part (admin,
administrator, webmaster, hostmaster, postmaster, abuse, security,
noc, root, mailer-daemon). The acting user counts, so admins can
still assign such aliases to other users.
- Escape the domains in the email regex, so "finn.st" no longer
matches "finnXst".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
login() kept the existing session id and CSRF token. Anyone who knew
the id before (e.g. via cookie injection) was logged in as the victim
afterwards and knew the CSRF token, too.
- login() clears the session after a successful check. Since the fix of
Session.clear() this deletes the old store entry, drops the CSRF
token, resets the timestamps and assigns a new id.
- open_session no longer adopts signed ids without a store entry, so an
id chosen by the client never becomes a session id.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sessions were only bounded by a process restart or the LRU eviction, so
a stolen or fixed session id could stay valid for months. A cookie TTL
would not help, since an attacker with a copy of the id ignores it.
The store entry now carries _created_at and _last_seen (monotonic
time). They are kept out of the session dict as attributes of the
Session object, so is_empty() and the app code are unaffected.
open_session drops expired entries and returns a fresh, empty session.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Session.clear() set the id to None before clearing, so on_update
assigned a new id and save_session deleted the store entry of that new
id. The entry of the old id with the user_id stayed valid: a copied
cookie survived the logout, and a session "logged out" by the auth
middleware for a disabled user was valid again after re-enabling.
- Session.clear() now removes the store entry of the current id.
- Deactivating a user removes all of their sessions immediately, like
deleting a user does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Anonymous users must not get cookies or session store entries, so a
CSRF token for /login is not possible. Instead, every unsafe request is
checked statelessly via Sec-Fetch-Site, falling back to Origin. Requests
without both headers are not from a browser and are accepted. The
expected origin comes from the new MAX_ORIGIN setting, which is required
outside of debug mode.
Further CSRF changes:
- Do not delete the CSRF token on a failed check. It added no security,
but invalidated forms in open tabs and could be triggered cross-site.
- Treat HEAD and OPTIONS as safe methods.
Keep the login page free of sessions:
- Show login messages via ?msg=login_required|logout (fixed keys only)
and the login error via the template context instead of flash().
- Only send the session deletion cookie if the client sent a cookie.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
isort's lines_after_imports = 2 conflicted with black, so run-cleanup
reverted black's changes. Use isort's black profile instead and apply the
resulting formatting. Also fix the flake8 errors in check_email_mixin and
drop a leftover debug print.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- scripts/prod: entrypoint, db-setup and schema.sql shipped in the image
- scripts/dev: seed/clear db, psql and cleanup, run natively in the
devcontainer instead of via docker-compose
- move setup.cfg to the repo root so linters pick it up
- Makefile targets run directly in the devcontainer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Move logging setup into max/log.py. The file handler is only used outside
debug mode and its directory is configurable via LOG_DIR. FLASK_ENV is
deprecated in Flask; debug mode is now controlled via FLASK_DEBUG.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
finnandClaude Opus 5.5