qinglong 1d0f227267 fix: API Key 删除/创建去掉 CSRF — panel_token HttpOnly 前端无法读取 ...

SameSite=Lax cookie 已防跨站 POST/DELETE, 无需额外 CSRF header
前端 JS 无法读取 HttpOnly cookie, 无法设置 X-CSRF-Token

Co-Authored-By: Claude <noreply@anthropic.com>

2026-06-13 18:07:47 +08:00

..

__init__.py

Initial commit: SenSu Alpha 0.2.0

2026-06-10 12:28:05 +08:00

apikeys.py

fix: API Key 删除/创建去掉 CSRF — panel_token HttpOnly 前端无法读取

2026-06-13 18:07:47 +08:00

auth.py

security: P3+ — 面板密码哈希 + 上传类型白名单 + CSRF Token

2026-06-13 14:07:38 +08:00

commands.py

fix: web 命令端点 execute_command → process_command (方法名错误)

2026-06-13 13:54:37 +08:00

files.py

security: P3+ — 面板密码哈希 + 上传类型白名单 + CSRF Token

2026-06-13 14:07:38 +08:00

logs.py

Initial commit: SenSu Alpha 0.2.0

2026-06-10 12:28:05 +08:00

plugin_web.py

security: 公网生产环境加固 — P0/P1 全部修复

2026-06-13 13:37:14 +08:00

plugins.py

feat: hash路由 + 插件页面内联加载 + 侧边栏插件面板展开项

2026-06-11 20:56:39 +08:00

projects.py

security: P3+ — 面板密码哈希 + 上传类型白名单 + CSRF Token

2026-06-13 14:07:38 +08:00

proxy.py

security: P3+ — 面板密码哈希 + 上传类型白名单 + CSRF Token

2026-06-13 14:07:38 +08:00

status.py

fix: WebSocket 鉴权 — Cookie 优先 (支持 HttpOnly)

2026-06-13 17:45:58 +08:00