drwily/Bellhop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reframe session key rotation as expected behavior, not a caveat

Browse Source 
A restart generating a new key and invalidating sessions is a
security feature, not a problem. Update docs to present it neutrally.

https://claude.ai/code/session_018iMt5qm4j9bk8wzytLC3E6
This commit is contained in:
Claude
2026-02-27 22:16:44 +00:00
parent bf6b1180de
commit 5ab96df34f
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@@ -114,7 +114,7 @@ Copy the `access_token` from the response.
| Variable | Default | Description |
|---|---|---|
| `SESSION_SECRET_KEY` | _(auto-generated)_ | Secret for signing session cookies. Auto-generated at startup if not set. Set this explicitly in production so sessions survive restarts. |
| `SESSION_SECRET_KEY` | _(auto-generated)_ | Secret for signing session cookies. Auto-generated at startup if not set. A new key is generated on every restart, which invalidates all existing sessions. |
| `DATABASE_PATH` | `bellhop.db` | Path to the SQLite database file |
## API Reference
@@ -244,7 +244,7 @@ Bellhop/
### Production Recommendations
- Run behind a reverse proxy (nginx, Caddy, Traefik) with TLS termination so the `secure` cookie flag works.
- Set `SESSION_SECRET_KEY` explicitly so sessions survive process restarts.
- If you want sessions to persist across restarts, set `SESSION_SECRET_KEY` explicitly. Otherwise, all users are logged out on restart.
- Restrict network access to your *arr instances — only the Bellhop container needs to reach them.
- Use a dedicated Matrix bot account for audit logging rather than a personal account.