Carlos Escalante b4123703ef Rate-limit logins, constant-time creds, pin CORS, secure cookie ...

Both login endpoints now share verify_admin_credentials (hmac
compare_digest, SEC-02) and a 5/min/IP sliding-window rate limit that
returns 429 with Retry-After (SEC-03). CORS is pinned to the prod
domain and localhost dev origins instead of '*' (SEC-04). The session
cookie's Secure flag is driven by COOKIE_SECURE instead of hardcoded
false (SEC-08).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-09 19:13:19 -06:00

4.8 KiB

Raw Blame History

View Raw