81778a2c2d
The API key is no longer sent as plaintext in HTTP responses. Instead, the frontend performs a reveal handshake: fetches the server's RSA public key, generates a session AES-256 key, RSA-OAEP wraps it, and the server returns the API key encrypted with AES-GCM. This protects the bearer token even when Studio is served over plain HTTP. |
||
|---|---|---|
| .. | ||
| assets | ||
| auth | ||
| core | ||
| loggers | ||
| models | ||
| plugins | ||
| requirements | ||
| routes | ||
| state | ||
| storage | ||
| tests | ||
| utils | ||
| __init__.py | ||
| _platform_compat.py | ||
| colab.py | ||
| main.py | ||
| run.py | ||
| startup_banner.py | ||