Claude
619515db96
Two hardening changes beyond just a password: - The admin panel no longer uses stored credentials at all. The backend generates a random API key on every startup and prints it to its own console (never through the DB-backed logger, since that's only reachable from inside the panel this key protects). Every /api/admin/* request must carry it as an X-Api-Key header, checked with a timing-safe comparison on every call — there's no session to create or steal, and restarting the backend invalidates the previous key immediately. The old admin_users and sessions tables, scrypt password hashing, and cookie-based session plumbing are removed entirely (dropped via migration for existing installs, not left behind unused). The login page keeps its existing layout but now asks for this key and explains where to find it, storing it in the browser's localStorage rather than relying on a server session. - The admin panel (the masthead's cog icon and the /admin/* pages themselves) is now disabled by default on every deployment, gated by a new frontend-only ADMIN_PANEL_ENABLED env var. This is a separate, UI-only visibility control — the API key above is what actually protects the backend regardless of this flag.
12 lines
445 B
Bash
12 lines
445 B
Bash
PORT=4000
|
|
FRONTEND_ORIGIN=http://localhost:5173
|
|
DB_PATH=./data/homefeed.db
|
|
MEDIA_DIR=./data/media
|
|
|
|
# There's no admin username/password to configure here — the backend generates a
|
|
# random API key on every startup and prints it to the console. Copy that key into
|
|
# the admin login page (every /api/admin/* request requires it as an X-Api-Key
|
|
# header). It changes on every restart, so check the console output each time.
|
|
|
|
NODE_ENV=development
|