3 Commits

Author	SHA1	Message	Date
opencode	bcae59626f	feat(security): add CSRF protection for all state-changing API routes ... - Synchronizer token stored in session; GET /auth/csrf to obtain it - csrfProtection middleware requires X-CSRF-Token on non-safe methods - customFetch injects the header via setCsrfTokenGetter - toolrate boot loads token; reload after local login (session regenerate) - OpenAPI GET /auth/csrf + CsrfToken schema, orval regenerated	2026-08-03 10:30:13 +02:00
root	4e0861df71	Fix Login: Session-Cookies via Vite-Proxy + credentials:include ... - Vite-Proxy für /api/* zum Express-Backend (localhost:8080) - credentials: 'include' in customFetch für Cross-Origin-Cookie-Support - Behebt: Login-Response-Set-Cookie wurde vom Browser ignoriert	2026-07-29 19:29:46 +02:00
agent	1de22a6979	Initial commit	2026-05-14 20:25:38 +00:00