web-player: fix open redirect via returnTo, require SESSION_SECRET and validate API inputs

2026-09-24 04:58:08 +02:00
parent b2f450dcf7
commit 3e546d4a1e
12 changed files with 64 additions and 13 deletions
@@ -11,8 +11,9 @@ ZITADEL_CLIENT_SECRET=your-web-app-client-secret
 AUTH_REDIRECT_URI=http://localhost:5173/auth/callback
 AUTH_POST_LOGOUT_URI=http://localhost:5173/

-# Secret used to derive the session cookie encryption key (any long random string)
-SESSION_SECRET=change-me-to-a-long-random-string
+# Secret used to derive the session cookie encryption key. Required, at least
+# 32 characters (e.g. `openssl rand -base64 48`).
+SESSION_SECRET=change-me-to-a-long-random-string-of-32-chars-or-more

 # Backend API base URL
 API_BASE_URL=http://localhost:5111