Fix login issue when accessing via IP address over HTTP. Previously,
the cookie secure flag was set based on NODE_ENV which caused
cookies to not be sent when accessing via HTTP in production mode.
Now it uses the actual request protocol (checking x-forwarded-proto
header or request URL).
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Add secure and sameSite attributes to cookie configuration
- Add try-catch block to handle malformed JSON and other errors
- Add validation for missing username or password fields
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Replace fs.readFileSync() with fs.createReadStream() to prevent memory exhaustion
- Export validatePath() from fs-utils.ts
- Use validatePath() to validate full path including project and version parameters
- Fix incomplete path traversal protection
- Add filename encoding in Content-Disposition header
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Add encodeURIComponent() for project, version, and filename parameters in downloadUrl to prevent XSS and URL breakage
- Remove unused formatDateTime import
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
