OAuth Security Fixes: SECRET_KEY validation, session cookies, error handling

[82deutschmark]

Summary

This PR implements critical OAuth security fixes and improves error handling as outlined in the OAuth security analysis.

Changes

Phase 1: Critical Security Fixes

• SECRET_KEY Validation: Now detects both your-secret-key AND dev-secret-key defaults (previously only checked one)
• Production Enforcement: Application fails fast in production if default SECRET_KEY is used
• Session Cookie Security: Added SECURE, HTTPONLY, and SAMESITE=Lax flags to prevent session hijacking
• Documentation: Updated .env examples with SECRET_KEY generation instructions

Phase 2: Error Handling & UX

• OAuth Callback Protection: Wrapped callback in try/except for graceful error handling
• Profile Validation: Added validation with clear error messages for missing required fields
• User Feedback: Login template now displays error messages to users
• Logging: Added warning logs when OAuth profiles are missing email addresses

Files Changed

• frontend_multi_user/src/app.py - Core OAuth security and error handling
• frontend_multi_user/templates/login.html - Error message display
• .env.developer-example - Updated documentation
• .env.docker-example - Updated documentation

Testing

Tested locally with:

• Default SECRET_KEY detection in dev mode (warning logged)
• Session cookie flags properly set
• Error handling for OAuth failures

Security Impact

Fixes the following vulnerabilities:

• Session hijacking via default SECRET_KEY (CRITICAL)
• Cookie theft via missing HTTPONLY/SECURE flags (HIGH)
• CSRF attacks via missing SAMESITE flag (MEDIUM)
• Poor UX on OAuth errors (LOW)

Related Issues

Addresses Issues #1, #3, #5, #6, #7 from OAUTH_ANALYSIS.md

Deployment Notes

⚠️IMPORTANT: Before deploying to production, ensure PLANEXE_FRONTEND_MULTIUSER_SECRET_KEY is set to a secure random value. Generate with:

python -c 'import secrets; print(secrets.token_hex(32))'```