Architecture: In-memory session store resets on server restart #27
Description
File: app/api/auth.py
Line: ~13
Description:
The backend uses a simple in-memory dictionary to track user sessions (_sessions: dict[str, str] = {}). Whenever the nullfeed-backend service is restarted or updated, the dictionary is cleared, instantly invalidating all active sessions.
Impact:
Users are forcibly logged out and must re-authenticate (e.g., on their TVs or phones) every time the backend container restarts.
Suggested Fix:
Store sessions in a persistent datastore (such as Redis or a sessions table in the SQLite database), or migrate to stateless signed JWTs instead of random strings.