admin/accounted
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: protect public Auth flows from automated abuse (#1904)

Browse Source 
* fix: add Turnstile to public auth flows

* test: isolate Turnstile auth tests
This commit is contained in:
Mattsson
2026-08-25 19:14:06 +02:00
committed by GitHub
parent 743bc82f93
commit 328ccda10d
15 changed files with 619 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+3
View File
@@ -42,6 +42,9 @@ ENV NEXT_PUBLIC_SESSION_IDLE_TIMEOUT_MS=__NEXT_PUBLIC_SESSION_IDLE_TIMEOUT_MS__
ENV NEXT_PUBLIC_SESSION_ABSOLUTE_TIMEOUT_MS=__NEXT_PUBLIC_SESSION_ABSOLUTE_TIMEOUT_MS__
ENV NEXT_PUBLIC_SESSION_WARNING_MS=__NEXT_PUBLIC_SESSION_WARNING_MS__
ENV NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=__NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL__
# Optional Supabase Auth bot protection. The site key is public; the matching
# secret belongs in GoTrue/Supabase Auth and must never be baked into this image.
ENV NEXT_PUBLIC_TURNSTILE_SITE_KEY=__NEXT_PUBLIC_TURNSTILE_SITE_KEY__
# Keep the branding placeholder intact through prebuild's inject script so
# docker-entrypoint.sh can substitute the runtime value into public/sw.js.
ENV NEXT_PUBLIC_BRANDING_APP_NAME=__NEXT_PUBLIC_BRANDING_APP_NAME__