security: validate sha256 digests, add login rate limiting, harden session cookies

2026-08-15 18:28:55 -04:00
parent 42d7f8eb18
commit 24250e06df
2 changed files with 83 additions and 5 deletions
@@ -24,6 +24,11 @@ MAX_DASHCAM_UPLOAD_MB=2048
 #   python -c "import secrets; print(secrets.token_hex(32))"
 SECRET_KEY=changeme_generate_a_real_secret_key

+# Mark session cookies Secure (HTTPS-only). The portal is served over HTTPS
+# via Cloudflare Tunnel, so leave this as 1 unless you also log in to the
+# portal over plain HTTP on the LAN.
+COOKIE_SECURE=1
+
 # The device name registered in the devices table - used by the portal to
 # scope all queries to the right Pi.
 DEVICE_NAME=yaris-2013