5 Commits

Include renames

Author	SHA1	Message	Date
Michael Nightingale	d73cdc7397	Stop treating routable special-purpose ranges as a local network	2026-09-08 22:44:12 +02:00
Michael Nightingale	c01371a6af	Refuse requests whose client a forwarded header hides	2026-09-08 22:44:12 +02:00
mnightingale	139b4a52b6	Run test coroutines on a thread of their own when a loop is already running	2026-08-30 17:01:15 +02:00
Safihre	b263c6cfe6	Replace anonymous session cookie with stable CSRF identity (#3596) ... Previously, UI access for login-bypassed clients relied on issuing a stateless "anonymous session" cookie to enable CSRF protection. This commit removes that cookie mechanism. Instead, when the login is bypassed (e.g., for local clients without credentials), the CSRF token is now bound to a stable, internal "anonymous" identity. This maintains robust CSRF protection for browser interactions without requiring an explicit session cookie, simplifying overall session management.	2026-08-28 11:19:54 +02:00
mnightingale	b192a7eca4	Persistent sessions, CSRF tokens, and no apikey in the web interface (#3559) ... * Add a session store that keeps web-UI logins in the admin folder * Authenticate the web interface with session cookies and CSRF tokens * Stop embedding the apikey in the web interface * Cover the session, CSRF and apikey changes	2026-08-27 13:05:12 +02:00