fix(security): secure cookies by default and unspoofable limiter keys

fix(security): secure cookies by default and unspoofable limiter keysOpenRTMP/librtmp2-server-panel #455 · 2 diagrams

100%

01 / 04Rate limiter now ignores spoofable proxy hopsThe limiter keys on X-Real-IP or the last appended XFF entry instead of trust-count indices. passes proxy headers to , changed in +2 −0 and +129 −3.
02 / 04Session cookies default to secureCookies now require HTTPS unless PANEL_ALLOW_INSECURE_HTTP=1 is set. enables Secure cookie flags by default in +129 −3 unless opted out.
03 / 04Gunicorn scanner tracks implicit dunder hooksConstructing classes that mutate workers via operator or format hooks flags dynamic configs. inspects special instance hooks and inherited methods in +129 −3.
04 / 04Everything this change touchedThe app runtime, proxy address resolution, cookie defaults, and AST scanner in one view.

esc to leave

StarHelp other teams find it