jappel/leistungsbilanz-ts
1
0
Fork 1
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions 3

Add AUTH_DEV_AUTOLOGIN to switch off the login on development instances

Browse source 
With AUTH_DEV_AUTOLOGIN=<username>, every /api request without a valid
session runs as that existing, active user and skips the forced password
change. Unset keeps the normal login; unknown or deactivated users still
get 401, real sessions take precedence, the CSRF application header stays
mandatory and the API logs a warning at startup. The switch is not
limited to localhost because the development instance is reached from
other machines and through a reverse proxy (THREATMODEL D2/R15). It must
never be set on an instance with real project data.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Julian Appel 2026-10-30 09:03:29 +01:00
parent 4677b1685c
commit 084002bea9
11 changed files with 211 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

3
compose.yaml
View file

@ -52,6 +52,9 @@ services:
AUTH_BOOTSTRAP_PASSWORT: "${AUTH_BOOTSTRAP_PASSWORT:-}"
AUTH_SESSION_HOURS: "${AUTH_SESSION_HOURS:-12}"
AUTH_SESSION_MAX_DAYS: "${AUTH_SESSION_MAX_DAYS:-7}"
# Nur Entwicklungsinstanzen: Benutzername, mit dem jede Anfrage ohne
# Session automatisch angemeldet ist (Login aus). Leer = Login aktiv.
AUTH_DEV_AUTOLOGIN: "${AUTH_DEV_AUTOLOGIN:-}"
COOKIE_SECURE: "${COOKIE_SECURE:-false}"
# Nicht auf dem Host veroeffentlicht: die API wird ueber den
# Next.js-Rewrite im Web-Dienst erreicht.