cesnimda
6 lines
571 B
Markdown
6 lines
571 B
Markdown
# Sessions and rate limits
|
|
|
|
Session cookies are HttpOnly and SameSite=Lax, with Secure behavior controlled by deployment. Mutating cookie-authenticated requests use a CSRF double-submit cookie/header check. Users can list and revoke sessions; logout clears local client state.
|
|
|
|
Dedicated fixed-window limits cover login, authentication email, two-factor challenges, and anonymous public-CV PDF export. AI usage is bounded by account/monthly generation and token policy. Rate limits are a security and capacity control; do not loosen them to mask provider or UI failures.
|