xTr1m/GameList
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Switch to signed cookie auth and stop leaking player IDs

Browse Source
This commit is contained in:
Frank Tovar
2026-02-05 16:28:22 +01:00
parent 67453d0756
commit a6265e8656
12 changed files with 100 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
IIS.md
View File

@@ -14,6 +14,7 @@
- `ADMIN_PASSWORD=<your-secret>`
- `BasePath=/vote` (only if the site is under a subfolder; omit for root)
- Optional: enable stdout logging in `web.config` during troubleshooting only; disable afterward.
- Data protection keys are persisted to `App_Data/keys`; ensure this folder is deployed and writable so auth cookies stay valid across app pool recycles.
## Permissions
- Grant modify rights to the app pool identity on `App_Data` (DB file + wal).