finnandClaude Opus 5.5
cc3d064e64
Sessions were only bounded by a process restart or the LRU eviction, so a stolen or fixed session id could stay valid for months. A cookie TTL would not help, since an attacker with a copy of the id ignores it. The store entry now carries _created_at and _last_seen (monotonic time). They are kept out of the session dict as attributes of the Session object, so is_empty() and the app code are unaffected. open_session drops expired entries and returns a fresh, empty session. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MAX
A small little program to manage emails.
The proxy should add X-Real-IP to get a better logging.
Setup
Requirements: Docker, Make
Start with make run-dev
Configuration
MAX_ORIGIN(required in production): The public origin of MAX, e.g.https://max.finn.st