# Security hardening: CSP, session revocation, and login fixes

[MSami625]

What Changed?

• Fix login/signup error handling so API validation errors display safely instead of crashing the page.
• Enforce Content-Security-Policy by default; add security config and env vars for CSP.
• Shorten Docker access token TTL to 15 minutes; set debug: false in config.docker.yml.
• Revoke tokens on org switch, user logout, and platform admin logout (JTI blacklist).
• Restrict GET /metrics to trusted IPs / operational.public (not session auth).
• Add tests for password policy, token revocation, and security headers.

Why?

Closes security gaps around CSP, session lifecycle, and ops endpoint exposure, and fixes a login UI crash when the API returns structured validation errors.

How to Test?

1. Login with an invalid email → error message shown, page does not crash.
2. curl -sI http://localhost:8000/ -X GET | grep -i content-security-policy → enforcing CSP header present.
3. Signup with weak password → 400 with policy error.
4. curl -s http://localhost:8000/metrics → 404 from a public client.
5. Login → logout → old token returns 401 on /api/v1/auth/me.
6. pytest tests/test_api/test_auth_routes.py tests/test_api/test_platform_admin.py tests/test_core/test_security_headers_middleware.py tests/test_core/test_operational_access_middleware.py -q

Release Label

• major - breaking change, next release bumps major version
• minor - backward-compatible feature, next release bumps minor version
• fix - backward-compatible bug fix, next release bumps patch version
• No label (defaults to patch release)

Checklist

• I have read the CONTRIBUTING.md guide.
• My code follows the project's style guidelines.
• I have added tests that prove my fix is effective or my feature works.
• I have updated documentation where needed.

[greptile-apps]

Too many files changed for review (176 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.