bvandeusenandClaude Opus 5.5 719dc62b0d fix(auth): set the session cookie's Secure flag behind a TLS-terminating proxy (M462 #4977) ...

The cookie set Secure from r.TLS, which is nil whenever TLS terminates at
Traefik or Cloudflare, so a public deployment's session cookie went out
without Secure. auth.IsHTTPS now decides it from X-Forwarded-Proto, believed
only through the trusted-hop count (rule 94) and read positionally like
X-Forwarded-For. Plain-HTTP and LAN logins are unchanged; nothing redirects.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 08:30:46 -04:00

..

admin_test.go

fix(auth): silence revive unused-parameter on stub test handlers

2026-04-29 17:58:43 -04:00

admin.go

feat(auth): add RequireAdmin middleware for /api/admin/* routes

2026-04-29 17:27:47 -04:00

clientip_test.go

fix(auth): set the session cookie's Secure flag behind a TLS-terminating proxy (M462 #4977)

2026-10-06 08:30:46 -04:00

clientip.go

fix(auth): set the session cookie's Secure flag behind a TLS-terminating proxy (M462 #4977)

2026-10-06 08:30:46 -04:00

middleware.go

feat(auth): active sessions API with origin/current IP — #370

2026-08-05 09:17:40 -04:00

ratelimit_test.go

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

ratelimit.go

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

session_test.go

feat(net): trusted-proxy depth so real client IPs survive a proxy — #2453

2026-08-05 10:07:43 -04:00

session.go

feat(net): trusted-proxy depth so real client IPs survive a proxy — #2453

2026-08-05 10:07:43 -04:00