bvandeusenandClaude Opus 5.5 719dc62b0d fix(auth): set the session cookie's Secure flag behind a TLS-terminating proxy (M462 #4977) ...

The cookie set Secure from r.TLS, which is nil whenever TLS terminates at
Traefik or Cloudflare, so a public deployment's session cookie went out
without Secure. auth.IsHTTPS now decides it from X-Forwarded-Proto, believed
only through the trusted-hop count (rule 94) and read positionally like
X-Forwarded-For. Plain-HTTP and LAN logins are unchanged; nothing redirects.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 08:30:46 -04:00

..

api

fix(auth): set the session cookie's Secure flag behind a TLS-terminating proxy (M462 #4977)

2026-10-06 08:30:46 -04:00

apierror

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

audit

feat(library): merge duplicates without losing history (M400 #3911)

2026-09-11 17:25:06 -04:00

auth

fix(auth): set the session cookie's Secure flag behind a TLS-terminating proxy (M462 #4977)

2026-10-06 08:30:46 -04:00

config

feat(tuning): scoring weights → DB-backed admin tuning lab

2026-07-03 09:22:03 -04:00

coplay

feat(taste): household co-play similarity — #1533

2026-07-14 10:07:19 -04:00

coverart

refactor(server): unify stream URL builders + MIME tables + cover-path helper

2026-06-04 08:29:51 -04:00

db

feat(admin): fingerprinting settings — on/off, length, match threshold, concurrency, sweep interval (M400 #3913)

2026-09-11 17:53:55 -04:00

dbtest

feat(admin): fingerprinting settings — on/off, length, match threshold, concurrency, sweep interval (M400 #3913)

2026-09-11 17:53:55 -04:00

eventbus

feat(#392): SSE event stream foundation — eventbus + /api/events/stream

2026-05-12 20:44:37 -04:00

gc

feat(discover): artist-tag cache for out-of-library candidates — #2376

2026-08-02 20:04:15 -04:00

library

feat(admin): fingerprinting settings — on/off, length, match threshold, concurrency, sweep interval (M400 #3913)

2026-09-11 17:53:55 -04:00

lidarr

fix(player+lidarr): mini-player sync race; durable approve + dedup

2026-05-18 12:24:20 -04:00

lidarrconfig

feat(admin): metadata-profile picker on integrations page

2026-05-02 00:09:13 -04:00

lidarrquarantine

fix(lidarrquarantine): pass dataDir at the four stub-client test constructors

2026-09-11 14:34:28 -04:00

lidarrrequests

fix(player+lidarr): mini-player sync race; durable approve + dedup

2026-05-18 12:24:20 -04:00

logging

feat(skel): slog logger factory with text|json format and level parsing

2026-04-18 21:20:10 +00:00

mailer

fix(ci): mailer + audit lint + settings Save button collision

2026-05-07 18:15:39 -04:00

mood

feat(taste): mood taste facet — #1534

2026-07-14 10:32:41 -04:00

netsettings

fix(net): validate hop range before checking availability — #2453

2026-08-05 10:27:10 -04:00

playevents

feat(taste): device-class context conditioning — #1551

2026-07-14 12:47:59 -04:00

playlists

fix(recommendation): make the candidate draw reproducible, not accidentally so

2026-09-11 08:44:33 -04:00

playsessions

test: add dbtest.ResetDB helper that preserves admin user

2026-04-29 11:55:06 -04:00

reacquisition

feat(library): a missing file asks Lidarr for itself, on a backoff — #2527

2026-08-16 23:53:21 -04:00

recommendation

fix(recommendation): make the candidate draw reproducible, not accidentally so

2026-09-11 08:44:33 -04:00

recsettings

fix(recommendation): Songs-like gets its own profile so it stops wandering

2026-09-10 20:51:15 -04:00

scrobble

fix(listenbrainz): similarity hits Labs API, not the 404'ing main API

2026-05-16 15:50:32 -04:00

server

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

similarity

test: fix 4 integration-suite root causes surfaced by CI (C+A+B+F)

2026-05-17 13:32:42 -04:00

subsonic

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

sync

fix(library): tell clients when a file goes missing or comes back — #2704

2026-08-17 13:04:14 -04:00

tags

feat(discover): artist-tag cache for out-of-library candidates — #2376

2026-08-02 20:04:15 -04:00

taste

feat(taste): mood taste facet — #1534

2026-07-14 10:32:41 -04:00

tracks

feat(library): merge duplicates without losing history (M400 #3911)

2026-09-11 17:25:06 -04:00