finnandClaude Opus 5.5
dc85c578a2
Anonymous users must not get cookies or session store entries, so a CSRF token for /login is not possible. Instead, every unsafe request is checked statelessly via Sec-Fetch-Site, falling back to Origin. Requests without both headers are not from a browser and are accepted. The expected origin comes from the new MAX_ORIGIN setting, which is required outside of debug mode. Further CSRF changes: - Do not delete the CSRF token on a failed check. It added no security, but invalidated forms in open tabs and could be triggered cross-site. - Treat HEAD and OPTIONS as safe methods. Keep the login page free of sessions: - Show login messages via ?msg=login_required|logout (fixed keys only) and the login error via the template context instead of flash(). - Only send the session deletion cookie if the client sent a cookie. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
31 lines
645 B
Makefile
31 lines
645 B
Makefile
# DEV
|
|
seed-dev: clear-dev
|
|
FLASK_APP=max.app FLASK_DEBUG=1 scripts/dev/seed-db.sh
|
|
|
|
clear-dev:
|
|
scripts/dev/clear-db.sh
|
|
|
|
run-dev:
|
|
FLASK_APP=max.app FLASK_DEBUG=1 flask run --host 0.0.0.0 --port 8757
|
|
|
|
run-dev-as-prod:
|
|
mkdir -p log
|
|
FLASK_APP=max.app LOG_DIR=log MAX_ORIGIN=http://localhost:8757 gunicorn -w 1 -b 0.0.0.0:8757 max.app:app
|
|
|
|
run-cleanup:
|
|
scripts/dev/cleanup.sh
|
|
|
|
# PROD
|
|
build-prod:
|
|
docker build -t max:$(shell cat VERSION) .
|
|
|
|
run-prod:
|
|
docker-compose up -d
|
|
|
|
stop-prod:
|
|
docker-compose down
|
|
|
|
setup-prod-initial-login:
|
|
docker-compose exec max flask add-domain finn.st
|
|
docker-compose exec max flask reset-admin admin@finn.st admin
|