88c3aa5149
Code-review feedback: - Hard-fail boot when AUTH_ENABLED=true and SESSION_SECRET is unset, so express-session can't silently use an in-memory random secret that invalidates sessions on restart and breaks multi-node clusters. - CORS rejection now returns cb(null, false) instead of cb(new Error) so misconfigured origins surface as clean CORS errors in the browser instead of HTTP 500s. Log a warn line for operator visibility. - pruneSessionInterval units comment. |
||
|---|---|---|
| .. | ||
| src | ||
| test | ||
| .env.example | ||
| .gitignore | ||
| Dockerfile | ||
| package.json | ||