# US07-02 — Harden API Authorization and Path Boundaries

Epic: [E07](../E07-hardening-release.md)

As an operator, I want the local application resistant to cross-origin and path attacks
so another process or webpage cannot access photos or trigger mutations.

## Acceptance criteria

- Session authentication, Origin/Host checks, SameSite cookies, CSRF protection, and
  restrictive CORS/default headers cover all mutation and media endpoints.
- Asset IDs, repeated root validation, symlink defense, upload limits, and schema
  validation prevent raw-path and race escapes.
- Errors reveal no secrets, filesystem internals, or private metadata unnecessarily.

## Automated tests

- Black-box security tests cover missing/invalid auth, CSRF, hostile origins/hosts,
  traversal, symlink races, malformed/oversized requests, and information leakage.

## Dependencies

- US07-01