From 429ceb1a21fff2c3ef9346002ea97bda9f8e4ecd Mon Sep 17 00:00:00 2001 From: Eric Wagoner Date: Mon, 3 Aug 2026 16:13:47 -0400 Subject: [PATCH] LAN access key: 128-bit token (was 48-bit for typability) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_016jXZFSTZQKzAC8fqpWSz9g --- src/bggpipe/webreview.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/bggpipe/webreview.py b/src/bggpipe/webreview.py index 99669af..56274fd 100644 --- a/src/bggpipe/webreview.py +++ b/src/bggpipe/webreview.py @@ -1080,7 +1080,10 @@ def run_web_review( import uvicorn url = f"http://127.0.0.1:{port}{landing}" - token = secrets.token_urlsafe(6) if lan else None + # 16 bytes = 128-bit key: standard session-credential strength. The + # cost is a longer one-time URL to get onto the phone — copy it, or + # type it once; the cookie remembers it from then on. + token = secrets.token_urlsafe(16) if lan else None if lan: ips = sorted(h for h in lan_hosts() if h.replace(".", "").isdigit()) names = sorted(h for h in lan_hosts() if not h.replace(".", "").isdigit())