Settings fields XIQUE_COOKIE_SECURE / XIQUE_LOGIN_ATTEMPT_LIMIT /
XIQUE_LOGIN_WINDOW_SECONDS plus a login_attempts store stub; failing tests
pin the Secure cookie flags, POST-only logout with session-bound CSRF, the
throttled login flow, migration 3, get_db close-on-exception, malformed
CSRF cookie halves, and empty/unicode password handling.

@@ -39,6 +42,9 @@ class Settings(BaseSettings):
     import_dir: Path = Path(tempfile.gettempdir()) / "xique-imports"
     log_level: str = "INFO"
     log_file: Path | None = None
+    cookie_secure: bool = False

@@ -40,2 +43,4 @@
     log_level: str = "INFO"
     log_file: Path | None = None
+    cookie_secure: bool = False
+    login_attempt_limit: int = 5

@@ -254,1 +262,3 @@
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="password is too long")
+    password_value = password or ""
+    _validate_credentials(username, password_value)
+    source_ip = request.client.host if request.client else "unknown"

@@ -255,0 +268,4 @@
+        source_ip=source_ip,
+        window_seconds=settings.login_window_seconds,
+    )
+    if recent_failures >= settings.login_attempt_limit:

@@ -260,2 +279,4 @@
+        await record_failed_login(db, username=username, source_ip=source_ip)
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="invalid username or password")
     if user["disabled_at"] is not None:
+        await record_failed_login(db, username=username, source_ip=source_ip)

@@ -288,3 +321,4 @@
+    verify_csrf(request, csrf_token or "")
     settings: Settings = request.app.state.settings
     token = request.cookies.get(settings.session_cookie_name)
     if token is not None:

@@ -0,0 +1,92 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""Tests for the login-attempt throttle store.
+
+Migration 3 adds the ``login_attempts`` table and :mod:`xique.db.login_attempts`

@@ -0,0 +65,4 @@
+async def test_old_failures_are_ignored(db: DbDep) -> None:
+    for _attempt in range(3):
+        await record_failed_login(db, username="marvin8", source_ip="203.0.113.7")
+    await db.execute(

@@ -107,6 +107,10 @@ Every setting is read from the environment with the `XIQUE_` prefix:
 | `XIQUE_IMPORT_DIR` | `<tempdir>/xique-imports` | directory uploaded Trakt export zips stream into |
 | `XIQUE_LOG_LEVEL` | `INFO` | minimum level for the log file (`DEBUG`–`CRITICAL`, case-insensitive) |
 | `XIQUE_LOG_FILE` | unset | log file path; unset logs errors to stdout only |
+| `XIQUE_COOKIE_SECURE` | `true` | add the `Secure` flag to session and CSRF cookies — set `false` only for plain-HTTP deployments without TLS |

@@ -39,6 +46,10 @@ class Settings(BaseSettings):
     import_dir: Path = Path(tempfile.gettempdir()) / "xique-imports"
     log_level: str = "INFO"
     log_file: Path | None = None
+    cookie_secure: bool = True

@@ -0,0 +1,93 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

@@ -157,0 +176,4 @@
+            address grouping is refused instead of collapsed.
+
+    """
+    if settings.trust_proxy_headers:

@@ -260,2 +343,4 @@
+    if not verify_password(password_value, str(user["password_hash"])):
+        await _record_failed_login(db, settings, username=username, source_ip=source_ip)
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="invalid username or password")
     if user["disabled_at"] is not None:

@@ -0,0 +1,494 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later

@@ -64,0 +85,4 @@
+    except ValidationError as error:
+        raised = True
+        expect(str(error)).to_contain(field)
+    expect(raised).to_be_truthy()

@@ -0,0 +84,4 @@
+        raised = True
+    expect(raised).to_be_truthy()
+
+    closed_cleanly = False

@@ -107,6 +107,10 @@ Every setting is read from the environment with the `XIQUE_` prefix:
 | `XIQUE_IMPORT_DIR` | `<tempdir>/xique-imports` | directory uploaded Trakt export zips stream into |
 | `XIQUE_LOG_LEVEL` | `INFO` | minimum level for the log file (`DEBUG`–`CRITICAL`, case-insensitive) |
 | `XIQUE_LOG_FILE` | unset | log file path; unset logs errors to stdout only |
+| `XIQUE_COOKIE_SECURE` | `true` | add the `Secure` flag to session and CSRF cookies — set `false` only for plain-HTTP deployments without TLS |

@@ -39,6 +46,10 @@ class Settings(BaseSettings):
     import_dir: Path = Path(tempfile.gettempdir()) / "xique-imports"
     log_level: str = "INFO"
     log_file: Path | None = None
+    cookie_secure: bool = True

@@ -0,0 +53,4 @@
+        "DELETE FROM login_attempts WHERE attempted_at < datetime('now', ?)",
+        (f"-{window_seconds} seconds",),
+    )
+    await db.commit()

@@ -0,0 +45,4 @@
+        "SELECT ?, ? "
+        "WHERE (SELECT COUNT(*) FROM login_attempts "
+        "WHERE username = ? AND source_ip = ? "
+        "AND attempted_at >= datetime('now', ?)) < ?",

@@ -0,0 +48,4 @@
+        "AND attempted_at >= datetime('now', ?)) < ?",
+        (username, source_ip, username, source_ip, f"-{window_seconds} seconds", limit),
+    ) as cursor:
+        recorded = cursor.rowcount == 1

@@ -0,0 +50,4 @@
+    ) as cursor:
+        recorded = cursor.rowcount == 1
+    await db.execute(
+        "DELETE FROM login_attempts WHERE attempted_at < datetime('now', ?)",

@@ -157,0 +184,4 @@
+        if usable:
+            return usable[-1]
+    if request.client is None:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="source address unavailable")

@@ -253,2 +328,2 @@
-    if len(password.encode()) > _MAX_PASSWORD_BYTES:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="password is too long")
+    password_value = password or ""
+    _validate_credentials(username, password_value)

@@ -255,0 +334,4 @@
+        source_ip=source_ip,
+        window_seconds=settings.login_window_seconds,
+    )
+    if recent_failures >= settings.login_attempt_limit:

@@ -64,0 +84,4 @@
+        Settings()
+    except ValidationError as error:
+        raised = True
+        expect(str(error)).to_contain(field)

@@ -0,0 +89,4 @@
+        await connection.execute("SELECT 1")
+    except ValueError:
+        closed_cleanly = True
+    expect(closed_cleanly).to_be_truthy()