jozamudi 882263d276 login POST now requires the X-Aniweb header: cross-site forced-login (attacker-form session swap) dies at the 403; login.html sends the header like the SPA

2026-09-16 02:41:25 +00:00

..

providers

Keep hianime alive across server rotation: try every listed server

2026-09-08 22:16:38 +00:00

__init__.py

move server code into server/, update docs

2026-08-19 15:33:31 +00:00

app.py

login POST now requires the X-Aniweb header: cross-site forced-login (attacker-form session swap) dies at the 403; login.html sends the header like the SPA

2026-09-16 02:41:25 +00:00

auth.py

login: per-source-IP failure budget (auth.py) — username rotation no longer dodges the lockout; sliding window, XFF trusted only behind the proxy (ANIWEB_TRUST_XFF); lockout logic now unit-testable (tests/test_auth.py)

2026-09-16 02:31:23 +00:00

db.py

storage: JSON files -> SQLite (users/history/searches/events)

2026-08-24 16:02:27 +00:00

upstream.py

Keep hianime alive across server rotation: try every listed server

2026-09-08 22:16:38 +00:00

users.py

storage: JSON files -> SQLite (users/history/searches/events)

2026-08-24 16:02:27 +00:00