fix(security) : Insecure defaults allow session hijacking via cookie sniffing and IP spoofing #499

Open

prince-shakyaa wants to merge 8 commits into

GenAI-Security-Project:mainfrom

prince-shakyaa:fix/insecure-config-defaults

Commits on May 15, 2026

fix: set secure cookie default to True and restrict proxy trusted hosts

Prince Shakya
authored and
Prince Shakya
committed

Commits on May 19, 2026

fix(security): revert proxy trusted hosts for PaaS support

Prince Shakya
authored and
Prince Shakya
committed
feat(security): make TRUSTED_PROXY_IPS an opt-in env var for strict hijack heuristics

Prince Shakya
authored and
Prince Shakya
committed
fix(security): improve untrusted IP log visibility and safe defaults

Prince Shakya
authored and
Prince Shakya
committed
test(security): add test coverage for proxy startup warnings and session IP heuristics

Prince Shakya
authored and
Prince Shakya
committed
fix(security): preserve structured logs and add rigorous security assertions

Prince Shakya
authored and
Prince Shakya
committed
test(security): harden logging format and behavior tests

Prince Shakya
authored and
Prince Shakya
committed
test(security): add explicit assertion for bare Settings() isolation

Prince Shakya
authored and
Prince Shakya
committed