81778a2c2d
The API key is no longer sent as plaintext in HTTP responses. Instead, the frontend performs a reveal handshake: fetches the server's RSA public key, generates a session AES-256 key, RSA-OAEP wraps it, and the server returns the API key encrypted with AES-GCM. This protects the bearer token even when Studio is served over plain HTTP. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| _html_to_md.py | ||
| audio_codecs.py | ||
| defaults.py | ||
| inference.py | ||
| key_exchange.py | ||
| llama_cpp.py | ||
| orchestrator.py | ||
| tools.py | ||
| worker.py | ||