No description
1abb1107a2
Address commit security review: replace the ?token= query fallback (which leaked the token into logs/referrers) with an HttpOnly, SameSite=Strict session cookie minted on the first header-authenticated request, so <img> media loads authenticate without a URL token. Use hmac.compare_digest for constant-time comparison and add Cache-Control: no-store + Referrer-Policy: no-referrer on untrusted biometric media. Also cover upload/import boundary validation (400) at the HTTP layer. |
||
|---|---|---|
| docs | ||
| src/rights_filter | ||
| tests | ||
| web/operator-gui | ||
| .env.example | ||
| .gitignore | ||
| package.json | ||
| requirements-dev.txt | ||
| requirements.txt | ||
| run_copyrighter_server.py | ||