bvandeusenandClaude Opus 5.5
96126b1c83
#5031 "Forged-request protection: SameSite cookie, per-session CSRF token on every non-GET, HTMX header". A page on another site could make a logged-in browser POST to Steward with the session cookie attached. - steward/auth/csrf.py: a per-session token, checked in one before_request for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field csrf_token, constant-time compare). The bearer-authenticated host-agent ingest is exempt; /mcp never reaches Quart. - Every POST form renders {{ csrf_field() }}; base.html carries the token in a meta tag and adds it to every HTMX request; the dashboard's fetch() calls send it. - The session cookie is SameSite=Lax; login issues a fresh token. - PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set when Settings → General was saved). - tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption, and a guard that every POST form in the templates carries the field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
51 lines
2.4 KiB
HTML
51 lines
2.4 KiB
HTML
{# steward/templates/settings/general.html #}
|
|
{% extends "base.html" %}
|
|
{% block title %}Settings — General — Steward{% endblock %}
|
|
{% block content %}
|
|
{% set active_tab = "general" %}
|
|
{% include "settings/_tabs.html" %}
|
|
|
|
<form method="post" action="/settings/general/">{{ csrf_field() }}
|
|
<div class="card" style="max-width:640px;">
|
|
<h2 class="section-title" style="margin-bottom:1.25rem;">General</h2>
|
|
|
|
<div class="form-group">
|
|
<label>Public base URL</label>
|
|
<input type="text" name="general.public_base_url"
|
|
value="{{ settings['general.public_base_url'] }}"
|
|
placeholder="https://monitor.example.com">
|
|
<div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.25rem;">
|
|
External URL where this Steward instance is reachable from the outside.
|
|
Leave blank to use whatever hostname you're currently browsing via.
|
|
Used by install scripts, share links, and alert notifications.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Session lifetime <span style="color:var(--text-muted);font-size:0.8rem;">(hours)</span></label>
|
|
<input type="number" name="session.lifetime_hours" min="1" max="720"
|
|
value="{{ settings['session.lifetime_hours'] }}" style="max-width:120px;">
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Data retention <span style="color:var(--text-muted);font-size:0.8rem;">(days)</span></label>
|
|
<input type="number" name="data.retention_days" min="1"
|
|
value="{{ settings['data.retention_days'] }}" style="max-width:120px;">
|
|
<div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.25rem;">Old ping/DNS results older than this are pruned by the cleanup job.</div>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Monitor poll interval <span style="color:var(--text-muted);font-size:0.8rem;">(seconds)</span></label>
|
|
<input type="number" name="monitors.poll_interval_seconds" min="10"
|
|
value="{{ settings['monitors.poll_interval_seconds'] }}" style="max-width:120px;">
|
|
<div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.25rem;">Requires restart to take effect.</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div style="margin-top:1rem;display:flex;align-items:center;gap:1rem;">
|
|
<button type="submit" class="btn">Save</button>
|
|
<span style="font-size:0.82rem;color:var(--text-muted);">Changes to session lifetime take effect immediately.</span>
|
|
</div>
|
|
</form>
|
|
{% endblock %}
|