finnandClaude Opus 5.5
9aed6b5227
The own SessionInterface ignored SESSION_COOKIE_SAMESITE, so the cookie was sent with every cross-site request in Firefox and Safari (CSRF, clickjacking in iframes, keeping the idle timeout alive). The cookie name "session" could also be set by other subdomains or via plain HTTP, the precondition for session fixation. - SameSite=Lax. No GET changes state, so links from mails keep working. - In production the cookie is named __Host-session, which browsers only accept with Secure, Path=/ and without Domain. The debug server keeps "session", since it runs without Secure. - set_cookie and delete_cookie use the same attributes, since browsers ignore the deletion of a __Host- cookie without Secure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MAX
A small little program to manage emails.
The proxy should add X-Real-IP to get a better logging.
Setup
Requirements: Docker, Make
Start with make run-dev
Configuration
MAX_ORIGIN(required in production): The public origin of MAX, e.g.https://max.finn.st