Function login_submit

src/web/app.py:219–238

(request: Request, password: str = Form(...), next: Optional[str] = "/")

    @app.post("/login")
    async def login_submit(request: Request, password: str = Form(...), next: Optional[str] = "/"):
        if is_default_security_config_active():
            return build_setup_password_redirect()

        expected = get_settings().webui_access_password.get_secret_value()
        if not secrets.compare_digest(password, expected):
            return _render_template(
                request,
                "login.html",
                {"error": "Invalid password", "next": next or "/", "notice": ""},
                status_code=401,
            )

        response = RedirectResponse(url=next or "/", status_code=302)
        auth_cookie = build_auth_token(
            expected,
            get_settings().webui_secret_key.get_secret_value(),
        )
        response.set_cookie("webui_auth", auth_cookie, httponly=True, samesite="lax")
        return response

    @app.get("/setup-password", response_class=HTMLResponse)
    async def setup_password_page(request: Request):