# Security hardening: CSP, session revocation, and login fixes

[MSami625]

What Changed?

• Fix login/signup error handling so API validation errors display safely instead of crashing the page.
• Enforce Content-Security-Policy by default; add security config and env vars for CSP.
• Shorten Docker access token TTL to 15 minutes; set debug: false in config.docker.yml.
• Revoke tokens on org switch, user logout, and platform admin logout (JTI blacklist).
• Restrict GET /metrics to trusted IPs / operational.public (not session auth).
• Add tests for password policy, token revocation, and security headers.

Why?

Closes security gaps around CSP, session lifecycle, and ops endpoint exposure, and fixes a login UI crash when the API returns structured validation errors.

How to Test?

1. Login with an invalid email → error message shown, page does not crash.
2. curl -sI http://localhost:8000/ -X GET | grep -i content-security-policy → enforcing CSP header present.
3. Signup with weak password → 400 with policy error.
4. curl -s http://localhost:8000/metrics → 404 from a public client.
5. Login → logout → old token returns 401 on /api/v1/auth/me.
6. pytest tests/test_api/test_auth_routes.py tests/test_api/test_platform_admin.py tests/test_core/test_security_headers_middleware.py tests/test_core/test_operational_access_middleware.py -q

Release Label

• major - breaking change, next release bumps major version
• minor - backward-compatible feature, next release bumps minor version
• fix - backward-compatible bug fix, next release bumps patch version
• No label (defaults to patch release)

Checklist

• I have read the CONTRIBUTING.md guide.
• My code follows the project's style guidelines.
• I have added tests that prove my fix is effective or my feature works.
• I have updated documentation where needed.

[greptile-apps]

Greptile Summary

This follow-up completes the logout fixes by clearing local sessions immediately, preserving captured credentials for server-side revocation, and containing failures from both revocation attempts.

• Adds access-token revocation for user organization switching and platform-admin logout.
• Uses raw authenticated requests for best-effort logout after browser credentials are cleared.
• Adds CSP configuration, operational endpoint restrictions, safer authentication error rendering, and platform security tests.

Confidence Score: 5/5

The PR appears safe to merge because the previously reported logout lifecycle failures are fixed and no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
frontend/src/store/authStore.ts	Captures user credentials, clears all local authentication and workspace state synchronously, then starts best-effort server revocation.
frontend/src/lib/api.ts	Sends captured logout credentials through raw Axios and terminates rejection chains after one retry.
frontend/src/store/platformAdminStore.ts	Clears the platform-admin browser session immediately while preserving the bearer token for asynchronous revocation.
app/api/v1/routes/auth.py	Reuses access-token revocation during logout and revokes local-password session credentials when switching organizations.
app/api/v1/routes/platform_admin.py	Adds an authenticated platform-admin logout endpoint that revokes the presented bearer token.
app/core/auth/platform_admin.py	Adds platform-token blacklisting and rejects revoked JTIs during platform authentication.

_{Reviews (4): Last reviewed commit: "fix(auth): improve error handling in ses..." | Re-trigger Greptile}