fix: harden auth timing, cookie attrs, password gen bias, email template escaping; add security tests

2026-04-08 20:45:16 +02:00
parent fe31ef5a3c
commit ca402eb88e
7 changed files with 549 additions and 25 deletions
--- a/docs/security.md
+++ b/docs/security.md
@@ -180,7 +180,7 @@ WARN: KEYWARDEN_TRUSTED_PROXIES not set – proxy headers (X-Forwarded-For) are
 - Cookie name: `keywarden_session`
 - Cookie flags:
  - `HttpOnly` — Not accessible via JavaScript
-  - `SameSite=Lax` — Prevents CSRF from external sites
+  - `SameSite=Strict` — Prevents CSRF from external sites
  - `Secure` — Only over HTTPS (when enabled)
  - `MaxAge=86400` — 24 hours
 - Sessions stored in-memory (not persisted across restarts)