Grovy311/leistungsbilanz-ts
1
0
Fork 0
forked from jappel/leistungsbilanz-ts
Code Pull requests Activity

Add AUTH_DEV_AUTOLOGIN to switch off the login on development instances

Browse source 
With AUTH_DEV_AUTOLOGIN=<username>, every /api request without a valid
session runs as that existing, active user and skips the forced password
change. Unset keeps the normal login; unknown or deactivated users still
get 401, real sessions take precedence, the CSRF application header stays
mandatory and the API logs a warning at startup. The switch is not
limited to localhost because the development instance is reached from
other machines and through a reverse proxy (THREATMODEL D2/R15). It must
never be set on an instance with real project data.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Julian Appel 2026-10-30 09:03:29 +01:00
parent 4677b1685c
commit 084002bea9
11 changed files with 211 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

4
.env.example
View file

@ -5,3 +5,7 @@ AUTH_SESSION_HOURS=12
AUTH_SESSION_MAX_DAYS=7
# Hinter HTTPS true, bei direktem HTTP-Zugriff im LAN false.
COOKIE_SECURE=false
# NUR Entwicklungsinstanzen ohne echte Projektdaten: vorhandener, aktiver
# Benutzer, als der jede Anfrage ohne Session angemeldet ist (Login aus).
# Leer lassen auf jeder produktiven Instanz.
AUTH_DEV_AUTOLOGIN=