Administrator session security

The embedded dashboard uses a server-side session, strict cookie policy, origin validation and per-session CSRF tokens.

Password storage

Passwords require at least 7 Unicode characters and use Argon2id with a random 16-byte salt, 64 MiB memory, three iterations and two lanes. Encoded parameters are bounded before verification to prevent attacker-controlled resource escalation.

Session contract

• Random 256-bit bearer token, stored only as a SHA-256 hash.
• 12-hour absolute expiry with server-side revocation.
• HttpOnly, SameSite=Strict, path-wide cookie.
• Secure for direct TLS or HTTPS reported by an explicitly trusted proxy.
• Origin and CSRF token enforcement for every state-changing dashboard request.

Login and logout

Unknown email, wrong password and disabled account return the same generic error. Failed attempts are bounded per resolved client address. Successful authentication rotates session material. The visible Log out action revokes the server-side session before returning to sign-in.

Proxy trust

Forwarded scheme and client headers are stripped unless the immediate peer belongs to TRESTLE_TRUSTED_PROXIES. The chain is evaluated from the server outward and stops at the first untrusted hop, preventing a browser from declaring itself HTTPS or choosing another rate-limit identity.

Automation is separate

Do not copy administrator cookies into scripts. Create a scoped personal token for operator automation or a service account for a deployed workload, then revoke it independently.