Authentication
Configure login methods, API access, rate limiting, and password storage.
Comicarr supports HTTP authentication, API key access, and several security hardening features.
HTTP Authentication
| Setting | Type | Default | Description |
|---|---|---|---|
HTTP_USERNAME | string | — | Login username. |
HTTP_PASSWORD | string | — | Login password. Stored as a bcrypt hash. |
Authentication Mode
| Setting | Type | Default | Description |
|---|---|---|---|
AUTHENTICATION | int | 0 | Authentication method: 0 = basic HTTP auth, 1 = form login, 2 = form-based login. |
Standard HTTP Basic authentication. The browser shows a native username/password dialog. Set AUTHENTICATION to 0.
This mode is simplest but does not support session management or login timeout. Credentials are sent with every request.
A web-based login form served by Comicarr. Set AUTHENTICATION to 1 or 2.
Form login supports session management, login timeout, and rate limiting. This is the recommended mode for most deployments.
Session Management
| Setting | Type | Default | Description |
|---|---|---|---|
LOGIN_TIMEOUT | int | 43800 | Session timeout in minutes. Default is approximately 30 days (43,800 minutes). |
Sessions are tracked server-side. The session key is regenerated on each successful login to prevent session fixation.
API Access
| Setting | Type | Default | Description |
|---|---|---|---|
API_ENABLED | bool | False | Enable the REST API. |
API_KEY | string | — | API key for authenticating API requests. Encrypted at rest. |
The API key is separate from your login credentials. Generate one through the UI on the Settings > Web Interface page. Pass it as the apikey query parameter or the X-Api-Key header.
Rate Limiting
Comicarr enforces rate limiting on the login endpoint to protect against brute-force attacks.
| Parameter | Value |
|---|---|
| Maximum attempts | 5 per IP |
| Lockout duration | 300 seconds (5 minutes) |
After 5 failed login attempts from a single IP address, that IP is locked out for 300 seconds. No configuration options exist for these values -- they are hardcoded for security.
Password Storage
Comicarr uses bcrypt with 12 salt rounds for password hashing.
| Setting | Type | Default | Description |
|---|---|---|---|
ENCRYPT_PASSWORDS | bool | True | Enable bcrypt hashing for stored passwords. |
SECURE_DIR | string | — | Directory for security-sensitive files (e.g. master.key). Defaults to <config_dir>/secure. |
Password Lifecycle
Password set via UI
The user enters a plaintext password on the settings page.
Bcrypt hash generated
Comicarr hashes the password using bcrypt with 12 rounds and stores only the hash in config.ini.
Login verification
On login, the submitted password is compared against the stored bcrypt hash. The plaintext password is never stored.
Legacy Migration
Older installations may have passwords stored as base64-encoded strings. Comicarr detects these on startup and automatically migrates them to bcrypt hashes. No user action is required.
Do not manually edit HTTP_PASSWORD in config.ini. The value must be a valid bcrypt hash. Use the web UI to change your password.