prosolis fd1682e11b Harden for public deployment behind a reverse proxy ...

The session cookie now sets the Secure attribute (server.secure_cookies, default true). Adds chi RealIP and Recoverer middleware plus a securityHeaders middleware that emits a Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy on every response. HSTS is intentionally left to the TLS-terminating proxy.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-14 12:10:50 -07:00

..

auth.go

Harden for public deployment behind a reverse proxy

2026-05-14 12:10:50 -07:00