photoanalyzer/delivery_backlog/stories/US07-02-security-hardening.md

US07-02 — Harden API Authorization and Path Boundaries

Epic: E07

As an operator, I want the local application resistant to cross-origin and path attacks so another process or webpage cannot access photos or trigger mutations.

Acceptance criteria

• Session authentication, Origin/Host checks, SameSite cookies, CSRF protection, and restrictive CORS/default headers cover all mutation and media endpoints.
• Asset IDs, repeated root validation, symlink defense, upload limits, and schema validation prevent raw-path and race escapes.
• Errors reveal no secrets, filesystem internals, or private metadata unnecessarily.

Automated tests

• Black-box security tests cover missing/invalid auth, CSRF, hostile origins/hosts, traversal, symlink races, malformed/oversized requests, and information leakage.

Dependencies

• US07-01