finnandClaude Opus 5.5
dc85c578a2
Anonymous users must not get cookies or session store entries, so a CSRF token for /login is not possible. Instead, every unsafe request is checked statelessly via Sec-Fetch-Site, falling back to Origin. Requests without both headers are not from a browser and are accepted. The expected origin comes from the new MAX_ORIGIN setting, which is required outside of debug mode. Further CSRF changes: - Do not delete the CSRF token on a failed check. It added no security, but invalidated forms in open tabs and could be triggered cross-site. - Treat HEAD and OPTIONS as safe methods. Keep the login page free of sessions: - Show login messages via ?msg=login_required|logout (fixed keys only) and the login error via the template context instead of flash(). - Only send the session deletion cookie if the client sent a cookie. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
29 lines
667 B
YAML
29 lines
667 B
YAML
services:
|
|
max:
|
|
image: max:1.1.0
|
|
depends_on:
|
|
- postgresql
|
|
ports:
|
|
- 127.0.0.1:8000:8000/tcp
|
|
environment:
|
|
- PGSQL_HOST=postgresql
|
|
- PGSQL_USER=max
|
|
- PGSQL_PASSWORD=max
|
|
- PGSQL_NAME=max
|
|
- MAX_ORIGIN=https://max.finn.st
|
|
networks:
|
|
- postgresql
|
|
- uplink
|
|
postgresql:
|
|
image: postgres:18.6
|
|
environment:
|
|
- POSTGRES_USER=max
|
|
- POSTGRES_PASSWORD=max
|
|
- POSTGRES_DB=max
|
|
networks:
|
|
- postgresql
|
|
networks:
|
|
postgresql:
|
|
internal: true
|
|
uplink:
|