finnandClaude Opus 5.5
dc85c578a2
Anonymous users must not get cookies or session store entries, so a CSRF token for /login is not possible. Instead, every unsafe request is checked statelessly via Sec-Fetch-Site, falling back to Origin. Requests without both headers are not from a browser and are accepted. The expected origin comes from the new MAX_ORIGIN setting, which is required outside of debug mode. Further CSRF changes: - Do not delete the CSRF token on a failed check. It added no security, but invalidated forms in open tabs and could be triggered cross-site. - Treat HEAD and OPTIONS as safe methods. Keep the login page free of sessions: - Show login messages via ?msg=login_required|logout (fixed keys only) and the login error via the template context instead of flash(). - Only send the session deletion cookie if the client sent a cookie. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
16 lines
284 B
Markdown
16 lines
284 B
Markdown
# MAX
|
|
|
|
A small little program to manage emails.
|
|
|
|
The proxy should add X-Real-IP to get a better logging.
|
|
|
|
## Setup
|
|
|
|
Requirements: Docker, Make
|
|
|
|
Start with `make run-dev`
|
|
|
|
## Configuration
|
|
|
|
- `MAX_ORIGIN` (required in production): The public origin of MAX, e.g.
|
|
`https://max.finn.st` |