marvin8/cang
Watch
1
0
Fork
You've already forked cang
 0
Code Issues 1 Pull requests Releases 28 Activity Actions

Roadmap #6: Password-manager-friendly login form #106

New issue
Closed
opened 2026-07-11 07:16:05 +00:00 by coding-agent-marvin8 · 1 comment
coding-agent-marvin8 commented 2026-07-11 07:16:05 +00:00 (Migrated from codeberg.org)
Copy link

The web UI currently uses HTTP Basic Auth, which modern password managers handle inconsistently and which does not support a proper logout flow. A standard HTML login form backed by a signed session cookie would be far more compatible with password managers and would give users an explicit log-out action.

The web UI currently uses HTTP Basic Auth, which modern password managers handle inconsistently and which does not support a proper logout flow. A standard HTML login form backed by a signed session cookie would be far more compatible with password managers and would give users an explicit log-out action.
coding-agent-marvin8 commented 2026-07-11 07:16:36 +00:00 (Migrated from codeberg.org)
Copy link

Plan of attack

Replaced the HTTPBasicAuth dependency with a stateless HMAC-SHA256 signed cookie. The secret key is derived from the configured password (SHA-256(password.encode())), so rotating the password automatically invalidates all existing sessions.

Key files:

  • src/cang/web/auth.py — complete rewrite; exports login_router (GET/POST /login, GET /logout), require_auth dependency, and NotAuthenticatedException; cookie name: cang_session, value: auth.<hmac-hex>
  • src/cang/web/app.py — registers login_router without auth dependency; adds @app.exception_handler(NotAuthenticatedException) → 303 to /login?next=<path>; adds auth_enabled Jinja2 global
  • src/cang/web/templates/login.html — new login form with autocomplete="username" and autocomplete="current-password" for password manager compatibility
  • src/cang/web/templates/base.html — conditional Log out link when auth_enabled
  • Open redirect prevention: _safe_next validates the next param must start with / and not //
**Plan of attack** Replaced the `HTTPBasicAuth` dependency with a stateless HMAC-SHA256 signed cookie. The secret key is derived from the configured password (`SHA-256(password.encode())`), so rotating the password automatically invalidates all existing sessions. Key files: - `src/cang/web/auth.py` — complete rewrite; exports `login_router` (GET/POST /login, GET /logout), `require_auth` dependency, and `NotAuthenticatedException`; cookie name: `cang_session`, value: `auth.<hmac-hex>` - `src/cang/web/app.py` — registers `login_router` without auth dependency; adds `@app.exception_handler(NotAuthenticatedException)` → 303 to `/login?next=<path>`; adds `auth_enabled` Jinja2 global - `src/cang/web/templates/login.html` — new login form with `autocomplete="username"` and `autocomplete="current-password"` for password manager compatibility - `src/cang/web/templates/base.html` — conditional Log out link when `auth_enabled` - Open redirect prevention: `_safe_next` validates the `next` param must start with `/` and not `//`
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
pages
2026.8.4
2026.7.25
2026.7.24
2026.7.23
2026.7.22
0.10.1
0.10.0
0.9.0
0.8.0
0.7.0
0.6.0
0.5.0
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.0
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
marvin8/cang#106
No description provided.