2 Commits

Include renames

Author	SHA1	Message	Date
Calcium-Ion	31d70fca39	refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329) ... * refactor(auth): replace dashboard sessions with stateless tokens * feat(auth): harden session issuance and distributed enforcement * fix(proxy): preserve trusted proxy compatibility defaults * refactor: address dashboard auth review feedback * refactor: remove classic frontend and flatten web app	2026-07-20 16:48:43 +08:00
CaIon	56dbaab1d4	feat(session): support opt-in Secure session cookies ... - add SESSION_COOKIE_SECURE / SESSION_COOKIE_TRUSTED_URL env vars with startup validation: enabling Secure requires at least one trusted HTTPS entry URL - wire common.SessionCookieSecure into the session cookie store instead of a hardcoded Secure=false - print a startup warning when Secure session cookies are disabled - document the new settings in .env.example and docker-compose files Secure stays off by default because many deployments front new-api with plain-HTTP reverse proxies, where a hardcoded Secure default would break logins entirely; enabling it safely depends on the deployment's TLS setup, so it ships as an opt-in deployment-hardening flag.	2026-07-05 13:53:16 +08:00