finnandClaude Opus 5.5
fc24ba068d
login() kept the existing session id and CSRF token. Anyone who knew the id before (e.g. via cookie injection) was logged in as the victim afterwards and knew the CSRF token, too. - login() clears the session after a successful check. Since the fix of Session.clear() this deletes the old store entry, drops the CSRF token, resets the timestamps and assigns a new id. - open_session no longer adopts signed ids without a store entry, so an id chosen by the client never becomes a session id. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MAX
A small little program to manage emails.
The proxy should add X-Real-IP to get a better logging.
Setup
Requirements: Docker, Make
Start with make run-dev
Configuration
MAX_ORIGIN(required in production): The public origin of MAX, e.g.https://max.finn.st