From 5ab96df34f2ffbf48bbfe2b1204106fed8f10f8b Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 27 Feb 2026 22:16:44 +0000 Subject: [PATCH] Reframe session key rotation as expected behavior, not a caveat A restart generating a new key and invalidating sessions is a security feature, not a problem. Update docs to present it neutrally. https://claude.ai/code/session_018iMt5qm4j9bk8wzytLC3E6 --- .env.example | 2 +- README.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.env.example b/.env.example index 06c539b..c75778a 100644 --- a/.env.example +++ b/.env.example @@ -25,6 +25,6 @@ LIDARR_QUALITY_PROFILE_ID=1 LIDARR_ROOT_FOLDER=/music # App -# SESSION_SECRET_KEY is auto-generated if omitted. Set it explicitly so sessions survive restarts. +# SESSION_SECRET_KEY is auto-generated if omitted. A new key on every restart invalidates all sessions. # SESSION_SECRET_KEY= DATABASE_PATH=bellhop.db diff --git a/README.md b/README.md index c8048a3..9d8242a 100644 --- a/README.md +++ b/README.md @@ -114,7 +114,7 @@ Copy the `access_token` from the response. | Variable | Default | Description | |---|---|---| -| `SESSION_SECRET_KEY` | _(auto-generated)_ | Secret for signing session cookies. Auto-generated at startup if not set. Set this explicitly in production so sessions survive restarts. | +| `SESSION_SECRET_KEY` | _(auto-generated)_ | Secret for signing session cookies. Auto-generated at startup if not set. A new key is generated on every restart, which invalidates all existing sessions. | | `DATABASE_PATH` | `bellhop.db` | Path to the SQLite database file | ## API Reference @@ -244,7 +244,7 @@ Bellhop/ ### Production Recommendations - Run behind a reverse proxy (nginx, Caddy, Traefik) with TLS termination so the `secure` cookie flag works. -- Set `SESSION_SECRET_KEY` explicitly so sessions survive process restarts. +- If you want sessions to persist across restarts, set `SESSION_SECRET_KEY` explicitly. Otherwise, all users are logged out on restart. - Restrict network access to your *arr instances — only the Bellhop container needs to reach them. - Use a dedicated Matrix bot account for audit logging rather than a personal account.