jozamudi 882263d276 login POST now requires the X-Aniweb header: cross-site forced-login (attacker-form session swap) dies at the 403; login.html sends the header like the SPA

2026-09-16 02:41:25 +00:00

..

conftest.py

login: per-source-IP failure budget (auth.py) — username rotation no longer dodges the lockout; sliding window, XFF trusted only behind the proxy (ANIWEB_TRUST_XFF); lockout logic now unit-testable (tests/test_auth.py)

2026-09-16 02:31:23 +00:00

test_api.py

login POST now requires the X-Aniweb header: cross-site forced-login (attacker-form session swap) dies at the 403; login.html sends the header like the SPA

2026-09-16 02:41:25 +00:00

test_auth.py

login: per-source-IP failure budget (auth.py) — username rotation no longer dodges the lockout; sliding window, XFF trusted only behind the proxy (ANIWEB_TRUST_XFF); lockout logic now unit-testable (tests/test_auth.py)

2026-09-16 02:31:23 +00:00

test_browser.py

CSRF header check now covers /login (exemption removed); login.html sends X-Aniweb

2026-09-16 02:02:09 +00:00

test_sources.py

Provider layer + hianime source (primary)

2026-09-07 01:38:53 +00:00