Julian Appel
084002bea9
With AUTH_DEV_AUTOLOGIN=<username>, every /api request without a valid session runs as that existing, active user and skips the forced password change. Unset keeps the normal login; unknown or deactivated users still get 401, real sessions take precedence, the CSRF application header stays mandatory and the API logs a warning at startup. The switch is not limited to localhost because the development instance is reached from other machines and through a reverse proxy (THREATMODEL D2/R15). It must never be set on an instance with real project data. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
11 lines
455 B
Text
11 lines
455 B
Text
# Nur beim ersten Start mit leerer Benutzertabelle erforderlich.
|
|
AUTH_BOOTSTRAP_USERNAME=
|
|
AUTH_BOOTSTRAP_PASSWORT=
|
|
AUTH_SESSION_HOURS=12
|
|
AUTH_SESSION_MAX_DAYS=7
|
|
# Hinter HTTPS true, bei direktem HTTP-Zugriff im LAN false.
|
|
COOKIE_SECURE=false
|
|
# NUR Entwicklungsinstanzen ohne echte Projektdaten: vorhandener, aktiver
|
|
# Benutzer, als der jede Anfrage ohne Session angemeldet ist (Login aus).
|
|
# Leer lassen auf jeder produktiven Instanz.
|
|
AUTH_DEV_AUTOLOGIN=
|