web: bokftui in the browser (ttyd + bokfweb login gate); per-user login limitv0.1.69

New image bokf-web (Dockerfile target "web", compose service "web" on
127.0.0.1:8790): Caddy routing with forward_auth, the bokfweb login gate
(C, authenticates with bokfd's session.open, per-address limit, cookie +
terminal handle, one login handed to the TUI via /redeem) and ttyd running
bokftui in web mode in an isolated throwaway HOME. TLS stays with the
host's reverse proxy. BOKF_WEB=1 blocks every local file and viewer path in
the TUI. bokfd's login limiter is now per user name instead of one global
counter (5 wrong guesses from anyone locked out everybody), and a full
counter table no longer disables it. The cross build and deploy.sh build
and ship both images.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

28 files changed, 1570 insertions, 59 deletions

diff --git a/AGENTS.md b/AGENTS.md
index f28a904..a1adc0c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,7 +2,8 @@
 
 `bokf` is a self-hosted Swedish bookkeeping system in C11: one daemon
 (`bokfd`) owning a SQLite database, one JSON protocol, three clients
-(`bokfctl`, `bokftui`, agents). GPL-3.0-or-later.
+(`bokfctl`, `bokftui` — also in the browser via `bokfweb` + ttyd — and
+agents). GPL-3.0-or-later.
 
 ## Build and test
 
@@ -19,7 +20,8 @@ vendored in `vendor/` and pinned; the only system library is libncursesw.
 | Path | What |
 |---|---|
 | `src/` | daemon, protocol, ledger, reports, SIE, seed, formula |
-| `clients/` | `bokfctl.c`, `bokftui.c`, shared `client.c` |
+| `clients/` | `bokfctl.c`, `bokftui.c`, `bokfweb.c` (web login gate), shared `client.c` |
+| `deploy/` | Dockerfile helpers, the web frontend's Caddyfile, entrypoint and `bokftui-web` |
 | `docs/` | PROTOCOL.md, SCHEMA.md, COMPLIANCE.md, TUI-GUIDELINES.md |
 | `tests/` | in-process protocol/ledger tests (`test_core.c`) |
 | `data/` | BAS charts (third-party, see THIRD_PARTY_NOTICES.md) |
diff --git a/Dockerfile b/Dockerfile
index 63d120f..a46e15e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,11 @@
 FROM alpine:3.24 AS build
 # VERSION is declared after the expensive layers: the legacy builder
 # invalidates every layer that follows a changed build argument.
-RUN apk add --no-cache build-base openssl-dev
+# Alpine's ncurses has no ncursesw/ include directory; the TUI includes
+# <ncursesw/ncurses.h> like Debian, so point it at the one header.
+RUN apk add --no-cache build-base openssl-dev ncurses-dev \
+ && mkdir -p /usr/include/ncursesw \
+ && ln -s ../ncurses.h /usr/include/ncursesw/ncurses.h
 WORKDIR /src
 COPY . .
 ARG VERSION=0.1.0-dev
@@ -12,16 +16,42 @@ ARG VERSION=0.1.0-dev
 # source on this host.
 RUN if [ -x .prebuilt/bokfd ]; then \
         mkdir -p build && \
-        cp .prebuilt/bokfd .prebuilt/bokfctl build/; \
+        cp .prebuilt/bokfd .prebuilt/bokfctl .prebuilt/bokftui \
+           .prebuilt/bokfweb build/; \
     else \
-        make -j"$(nproc)" backend VERSION="$VERSION" \
+        make -j"$(nproc)" backend build/bokftui build/bokfweb \
+             VERSION="$VERSION" \
         && make test-core VERSION="$VERSION"; \
     fi \
- && strip build/bokfd build/bokfctl
+ && strip build/bokfd build/bokfctl build/bokftui build/bokfweb
+
+# The web frontend (image bokf-web, `--target web`): Caddy for routing, the
+# bokfweb login gate, ttyd and bokftui in web mode. It reaches bokfd only
+# through the protocol socket; no database, no secrets, no certificates
+# (TLS is the host's reverse proxy). Everything runs as an unprivileged
+# user; Caddy listens on 8790.
+FROM alpine:3.24 AS web
+RUN apk add --no-cache ca-certificates caddy ttyd ncurses-terminfo-base \
+        ncurses-libs libssl3 libcrypto3 \
+ && addgroup -S bokfd \
+ && adduser -S -D -H -u 10001 -G bokfd -s /sbin/nologin bokfd
+COPY --from=build /src/build/bokftui /src/build/bokfweb /usr/local/bin/
+COPY deploy/bokftui-web deploy/web-entrypoint.sh /usr/local/bin/
+COPY deploy/Caddyfile /etc/caddy/Caddyfile
+RUN chmod 0755 /usr/local/bin/bokftui-web /usr/local/bin/web-entrypoint.sh
+ENV BOKFD_SOCKET=/run/bokfd/bokfd.sock \
+    TERM=xterm-256color \
+    LANG=C.UTF-8
+USER 10001
+EXPOSE 8790
+HEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \
+    CMD ["wget", "-q", "-O", "/dev/null", "http://127.0.0.1:7682/healthz"]
+ENTRYPOINT ["/usr/local/bin/web-entrypoint.sh"]
 
 # The runtime image carries the daemon and bokfctl only, statically linked
-# against OpenSSL and the C library; the ncurses TUI is a frontend built on the
-# machine you sit at.
+# against OpenSSL and the C library; the ncurses TUI is a frontend (on the
+# machine you sit at, or in the web image above). It is the last stage, so a
+# plain `docker build` still produces it.
 FROM alpine:3.24 AS runtime
 RUN apk add --no-cache ca-certificates util-linux \
  && addgroup -S bokfd \
diff --git a/Makefile b/Makefile
index d797efe..dfe5f9f 100644
--- a/Makefile
+++ b/Makefile
@@ -33,7 +33,7 @@ CORE_SRC = src/util.c src/log.c src/config.c src/db.c src/auth.c \
 VENDOR_OBJ = $(patsubst %.c,$(BUILD)/%.o,$(VENDOR_SRC))
 CORE_OBJ   = $(patsubst %.c,$(BUILD)/%.o,$(CORE_SRC))
 
-all: $(BUILD)/bokfd $(BUILD)/bokfctl $(BUILD)/bokftui
+all: $(BUILD)/bokfd $(BUILD)/bokfctl $(BUILD)/bokftui $(BUILD)/bokfweb
 
 backend: $(BUILD)/bokfd $(BUILD)/bokfctl
 
@@ -76,6 +76,19 @@ $(BUILD)/test_tui: $(BUILD)/tests/test_tui.o $(BUILD)/clients/tui.o \
                    $(BUILD)/vendor/sha256.o
 	$(CC) $(CFLAGS) -o $@ $^ -lm -lncursesw
 
+# The login gate in front of the browser terminal (deploy/Dockerfile web
+# stage); a protocol client like bokfctl, no ncurses.
+$(BUILD)/bokfweb: $(BUILD)/clients/bokfweb.o $(BUILD)/clients/web.o \
+                  $(BUILD)/clients/client.o \
+                  $(BUILD)/src/util.o $(BUILD)/src/log.o $(BUILD)/vendor/yyjson.o \
+                  $(BUILD)/vendor/sha256.o
+	$(CC) $(CFLAGS) -o $@ $^ -lm $(SSL_LIBS)
+
+$(BUILD)/test_web: $(BUILD)/tests/test_web.o $(BUILD)/clients/web.o \
+                   $(BUILD)/src/util.o $(BUILD)/src/log.o \
+                   $(BUILD)/vendor/sha256.o
+	$(CC) $(CFLAGS) -o $@ $^ -lm
+
 $(BUILD)/test_pdf: $(BUILD)/tests/pdf_check.o $(BUILD)/src/pdf.o \
                    $(BUILD)/src/util.o $(BUILD)/vendor/sha256.o
 	$(CC) $(CFLAGS) -o $@ $^ -lm
@@ -97,9 +110,10 @@ gen-protocol: $(BUILD)/gen_protocol
 	$(BUILD)/gen_protocol --write docs/PROTOCOL.md
 
 test: check $(BUILD)/test_core $(BUILD)/test_tui $(BUILD)/test_pdf \
-      $(BUILD)/test_invoice $(BUILD)/test_smtp
+      $(BUILD)/test_invoice $(BUILD)/test_smtp $(BUILD)/test_web
 	$(BUILD)/test_core
 	$(BUILD)/test_tui
+	$(BUILD)/test_web
 	$(BUILD)/test_pdf
 	$(BUILD)/test_invoice
 	$(BUILD)/test_smtp
@@ -160,6 +174,8 @@ $(BUILD)/tests/%.o: tests/%.c
          $(BUILD)/clients/ui.d $(TUI_SCREEN_DEP) \
          $(BUILD)/clients/tui.d $(BUILD)/clients/client.d \
          $(BUILD)/clients/drafts.d $(BUILD)/clients/vlist.d \
+         $(BUILD)/clients/web.d $(BUILD)/clients/bokfweb.d \
+         $(BUILD)/tests/test_web.d \
          $(BUILD)/tests/test_core.d $(BUILD)/tests/test_tui.d \
          $(BUILD)/tests/pdf_check.d $(BUILD)/tests/invoice_check.d \
          $(BUILD)/tests/smtp_check.d \
@@ -168,7 +184,7 @@ $(BUILD)/tests/%.o: tests/%.c
 install: all
 	install -d $(DESTDIR)/usr/local/bin $(DESTDIR)/usr/local/share/bokf
 	install -m 0755 $(BUILD)/bokfd $(BUILD)/bokfctl $(BUILD)/bokftui \
-	    $(DESTDIR)/usr/local/bin/
+	    $(BUILD)/bokfweb $(DESTDIR)/usr/local/bin/
 	install -m 0644 data/bas_k2.csv data/bas_k3.csv $(DESTDIR)/usr/local/share/bokf/
 
 clean:
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 7871e67..029bd3f 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -10,6 +10,15 @@ components are vendored in `vendor/` and are compatible with that license.
 | SHA-256 (Brad Conte) | master@2026-09 | Public domain | https://github.com/B-Con/crypto-algorithms |
 | Argon2 reference | 20190702 | CC0-1.0 / Apache-2.0 (`vendor/argon2.LICENSE`) | https://github.com/P-H-C/phc-winner-argon2 |
 
+The web frontend image (`bokf-web`) installs these from Alpine Linux
+packages at build time; they are not part of this repository:
+
+| Component | License | Source |
+|---|---|---|
+| Caddy | Apache-2.0 | https://caddyserver.com/ |
+| ttyd (with xterm.js) | MIT | https://github.com/tsl0922/ttyd |
+| ncurses | MIT-style (X11) | https://invisible-island.net/ncurses/ |
+
 The wordmark outlines in `src/wordmark.h` are derived from the Comfortaa
 typeface by Johan Aakerlund, licensed under the SIL Open Font License,
 Version 1.1 (https://scripts.sil.org/OFL). The header is generated by
diff --git a/clients/bokfweb.c b/clients/bokfweb.c
new file mode 100644
index 0000000..d04e2d6
--- /dev/null
+++ b/clients/bokfweb.c
@@ -0,0 +1,479 @@
+/* bokfweb: the login gate in front of the browser terminal.
+
+   Caddy terminates TLS and asks this gate (forward_auth, GET /auth) before
+   it proxies anything to ttyd. A login page checks the credentials with
+   bokfd's own session.open, so the web has no password store of its own
+   and bokfd's audit applies. A successful login gets a cookie (never in a
+   URL) and a terminal handle (in the ttyd URL, ?arg=); /auth accepts a
+   request only with a live cookie whose session owns the handle in the
+   URL, and only while the bokfd session is alive. The terminal wrapper
+   trades the handle for the bokfd session on the internal /redeem, so the
+   TUI starts logged in. Failed logins are limited per client address
+   before bokfd's own limiter is reached.
+
+   Listens on BOKFWEB_LISTEN (default 127.0.0.1:7682) and is not exposed
+   directly: only Caddy and the wrapper in the same container talk to it. */
+#include <arpa/inet.h>
+#include <errno.h>
+#include <netinet/in.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <unistd.h>
+
+#include "client.h"
+#include "log.h"
+#include "util.h"
+#include "web.h"
+#include "yyjson.h"
+
+#define COOKIE "bokf_web"
+
+struct gate {
+    const char *bokfd; /* bokfd target, e.g. /run/bokfd/bokfd.sock */
+    const char *base;  /* URL prefix, e.g. /web */
+    int secure;        /* Secure cookie (off only for plain-http tests) */
+    struct web_store st;
+    struct web_rl rl;
+};
+
+/* One call on a fresh connection; the response line or NULL. */
+static char *bokfd_call(const struct gate *g, const char *cmd,
+                        const char *session, const char *args)
+{
+    struct client_conn c;
+    if (client_connect(g->bokfd, &c) != 0) {
+        log_warn("bokfd unreachable: %s", client_last_error());
+        return NULL;
+    }
+    char *resp = client_rpc(&c, cmd, session, 0, args);
+    client_close(&c);
+    return resp;
+}
+
+static int bokfd_alive(const struct gate *g, const char *session)
+{
+    char *resp = bokfd_call(g, "session.whoami", session, "{}");
+    int ok = resp && client_ok(resp);
+    free(resp);
+    return ok;
+}
+
+/* error.code of a response line into code ("" when none). */
+static void error_code(const char *resp, char *code, size_t n)
+{
+    code[0] = '\0';
+    yyjson_doc *d = resp ? yyjson_read(resp, strlen(resp), 0) : NULL;
+    yyjson_val *root = d ? yyjson_doc_get_root(d) : NULL;
+    yyjson_val *e = root ? yyjson_obj_get(root, "error") : NULL;
+    yyjson_val *c = e ? yyjson_obj_get(e, "code") : NULL;
+    if (c && yyjson_is_str(c))
+        snprintf(code, n, "%s", yyjson_get_str(c));
+    yyjson_doc_free(d);
+}
+
+/* --- responses ---------------------------------------------------- */
+
+static void send_all(int fd, const char *p, size_t n)
+{
+    while (n > 0) {
+        ssize_t w = send(fd, p, n, MSG_NOSIGNAL);
+        if (w <= 0) {
+            if (w < 0 && errno == EINTR)
+                continue;
+            return;
+        }
+        p += w;
+        n -= (size_t)w;
+    }
+}
+
+static void respond(int fd, const char *status, const char *extra_headers,
+                    const char *ctype, const char *body, size_t blen)
+{
+    char h[1536];
+    int n = snprintf(
+        h, sizeof h,
+        "HTTP/1.1 %s\r\n"
+        "Connection: close\r\n"
+        "Cache-Control: no-store\r\n"
+        "X-Content-Type-Options: nosniff\r\n"
+        "X-Frame-Options: DENY\r\n"
+        "Referrer-Policy: no-referrer\r\n"
+        "Content-Security-Policy: default-src 'none'; style-src"
+        " 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'\r\n"
+        "%s%s%s%s"
+        "Content-Length: %zu\r\n\r\n",
+        status, extra_headers ? extra_headers : "",
+        ctype ? "Content-Type: " : "", ctype ? ctype : "",
+        ctype ? "\r\n" : "", blen);
+    if (n <= 0 || (size_t)n >= sizeof h)
+        return;
+    send_all(fd, h, (size_t)n);
+    if (body && blen)
+        send_all(fd, body, blen);
+}
+
+static void redirect(int fd, const char *location, const char *extra)
+{
+    char h[768];
+    snprintf(h, sizeof h, "Location: %s\r\n%s", location, extra ? extra : "");
+    respond(fd, "303 See Other", h, NULL, NULL, 0);
+}
+
+static void text(int fd, const char *status, const char *body)
+{
+    respond(fd, status, NULL, "text/plain; charset=utf-8", body,
+            strlen(body));
+}
+
+static void buf_puts(struct buf *b, const char *s)
+{
+    buf_append(b, s, strlen(s));
+}
+
+static void login_page(int fd, const struct gate *g, const char *error,
+                       const char *user)
+{
+    struct buf b;
+    buf_init(&b);
+    static const char head[] =
+        "<!doctype html>\n<html lang=\"sv\"><head><meta charset=\"utf-8\">"
+        "<meta name=\"viewport\" content=\"width=device-width,"
+        "initial-scale=1\"><title>bokf — logga in</title><style>"
+        "body{font-family:system-ui,sans-serif;background:#1d2327;"
+        "color:#e8e8e8;display:flex;min-height:100vh;margin:0;"
+        "align-items:center;justify-content:center}"
+        "form{background:#2a3136;padding:2rem 2.2rem;border-radius:6px;"
+        "width:18rem}h1{font-size:1.3rem;margin:0 0 1.2rem}"
+        "label{display:block;font-size:.85rem;margin:.9rem 0 .3rem}"
+        "input{width:100%;box-sizing:border-box;padding:.55rem;border:1px "
+        "solid #56616a;border-radius:4px;background:#1d2327;color:#fff;"
+        "font-size:1rem}button{margin-top:1.4rem;width:100%;padding:.6rem;"
+        "border:0;border-radius:4px;background:#3d8fd1;color:#fff;"
+        "font-size:1rem;cursor:pointer}.err{background:#5c2b2b;"
+        "padding:.6rem;border-radius:4px;font-size:.9rem}"
+        "p.note{font-size:.8rem;color:#9aa5ad;margin-top:1.2rem}"
+        "</style></head><body>";
+    buf_puts(&b, head);
+    buf_puts(&b, "<form method=\"post\" action=\"");
+    web_html_escape(&b, g->base);
+    buf_puts(&b, "/login\"><h1>bokf</h1>");
+    if (error && *error) {
+        buf_puts(&b, "<div class=\"err\" role=\"alert\">");
+        web_html_escape(&b, error);
+        buf_puts(&b, "</div>");
+    }
+    static const char fields1[] =
+        "<label for=\"u\">Användarnamn</label>"
+        "<input id=\"u\" name=\"username\" autocomplete=\"username\" "
+        "autocapitalize=\"none\" required autofocus value=\"";
+    buf_puts(&b, fields1);
+    web_html_escape(&b, user ? user : "");
+    static const char fields2[] =
+        "\"><label for=\"p\">Lösenord</label>"
+        "<input id=\"p\" name=\"password\" type=\"password\" "
+        "autocomplete=\"current-password\" required>"
+        "<button type=\"submit\">Logga in</button>"
+        "<p class=\"note\">Samma konto som i bokftui. Efter inloggningen "
+        "öppnas bokföringen i en terminal i webbläsaren.</p>"
+        "</form></body></html>\n";
+    buf_puts(&b, fields2);
+    respond(fd, "200 OK", NULL, "text/html; charset=utf-8",
+            (const char *)b.p, b.len);
+    buf_free(&b);
+}
+
+/* --- handlers ----------------------------------------------------- */
+
+static const char *client_addr(const struct web_req *r, char *buf, size_t n)
+{
+    /* Caddy sets X-Forwarded-For to the real client; take the first hop */
+    if (!r->forwarded_for[0])
+        return "direct";
+    snprintf(buf, n, "%s", r->forwarded_for);
+    char *comma = strchr(buf, ',');
+    if (comma)
+        *comma = '\0';
+    return util_str_trim(buf);
+}
+
+static struct web_session *cookie_session(struct gate *g,
+                                          const struct web_req *r)
+{
+    char tok[128];
+    if (web_cookie_get(r->cookie, COOKIE, tok, sizeof tok) != 0)
+        return NULL;
+    return web_store_by_token(&g->st, tok, util_now());
+}
+
+/* The cookie's session when the bokfd session behind it is alive;
+   a dead one is dropped. */
+static struct web_session *live_session(struct gate *g,
+                                        const struct web_req *r)
+{
+    struct web_session *s = cookie_session(g, r);
+    if (s && !bokfd_alive(g, s->bokf)) {
+        log_info("web session of %s ended (bokfd session gone)", s->user);
+        web_store_del(s);
+        s = NULL;
+    }
+    return s;
+}
+
+static void to_terminal(int fd, const struct gate *g,
+                        const struct web_session *s, const char *extra)
+{
+    char loc[256];
+    snprintf(loc, sizeof loc, "%s/tty/?arg=%s", g->base, s->handle);
+    redirect(fd, loc, extra);
+}
+
+static void h_login_post(int fd, struct gate *g, const struct web_req *r)
+{
+    char abuf[64], user[64] = "", pass[256] = "";
+    const char *addr = client_addr(r, abuf, sizeof abuf);
+    int64_t now = util_now();
+    int64_t wait = web_rl_blocked(&g->rl, addr, now);
+    if (wait > 0) {
+        char msg[128];
+        snprintf(msg, sizeof msg,
+                 "För många misslyckade försök. Försök igen om %lld min.",
+                 (long long)(wait + 59) / 60);
+        login_page(fd, g, msg, NULL);
+        return;
+    }
+    if (web_form_get(r->body, r->body_len, "username", user, sizeof user) ||
+        web_form_get(r->body, r->body_len, "password", pass, sizeof pass) ||
+        !user[0] || !pass[0]) {
+        login_page(fd, g, "Fyll i användarnamn och lösenord.", user);
+        return;
+    }
+    struct client_conn c;
+    if (client_connect(g->bokfd, &c) != 0) {
+        memset(pass, 0, sizeof pass);
+        log_warn("bokfd unreachable: %s", client_last_error());
+        login_page(fd, g, "Servern svarar inte just nu. Försök igen strax.",
+                   user);
+        return;
+    }
+    char *session = NULL, *err = NULL;
+    int rc = client_login(&c, user, pass, &session, &err);
+    client_close(&c);
+    memset(pass, 0, sizeof pass);
+    if (rc != 0) {
+        char code[48];
+        error_code(err, code, sizeof code);
+        free(err);
+        if (strcmp(code, "RATE_LIMITED") == 0) {
+            login_page(fd, g,
+                       "Inloggningen är tillfälligt spärrad efter för många "
+                       "felaktiga försök. Försök igen om en stund.",
+                       user);
+            return;
+        }
+        if (strcmp(code, "AUTH_FAILED") == 0) {
+            web_rl_fail(&g->rl, addr, now);
+            log_info("web login failed for %s from %s", user, addr);
+            login_page(fd, g, "Fel användarnamn eller lösenord.", user);
+            return;
+        }
+        log_warn("web login error for %s: %s", user, code[0] ? code : "?");
+        login_page(fd, g, "Inloggningen misslyckades. Försök igen strax.",
+                   user);
+        return;
+    }
+    web_rl_ok(&g->rl, addr);
+    struct web_session *s = web_store_add(&g->st, session, user, now);
+    free(session);
+    log_info("web login %s from %s", user, addr);
+    char cookie[256];
+    snprintf(cookie, sizeof cookie,
+             "Set-Cookie: " COOKIE "=%s; Path=%s; HttpOnly;%s SameSite=Strict;"
+             " Max-Age=%d\r\n",
+             s->token, g->base, g->secure ? " Secure;" : "",
+             WEB_SESSION_TTL);
+    to_terminal(fd, g, s, cookie);
+}
+
+static void h_logout(int fd, struct gate *g, const struct web_req *r)
+{
+    struct web_session *s = cookie_session(g, r);
+    if (s) {
+        free(bokfd_call(g, "session.close", s->bokf, "{}"));
+        log_info("web logout %s", s->user);
+        web_store_del(s);
+    }
+    char clear[192], loc[160];
+    snprintf(clear, sizeof clear,
+             "Set-Cookie: " COOKIE "=; Path=%s; HttpOnly;%s SameSite=Strict;"
+             " Max-Age=0\r\n",
+             g->base, g->secure ? " Secure;" : "");
+    snprintf(loc, sizeof loc, "%s/", g->base);
+    redirect(fd, loc, clear);
+}
+
+/* forward_auth: 200 lets Caddy proxy to ttyd, anything else goes back to
+   the browser. A handle in the URL must belong to the cookie's session. */
+static void h_auth(int fd, struct gate *g, const struct web_req *r)
+{
+    struct web_session *s = live_session(g, r);
+    if (!s) {
+        char loc[160];
+        snprintf(loc, sizeof loc, "%s/", g->base);
+        redirect(fd, loc, NULL);
+        return;
+    }
+    const char *q = strchr(r->forwarded_uri, '?');
+    char arg[128];
+    if (q && web_form_get(q + 1, strlen(q + 1), "arg", arg, sizeof arg) == 0 &&
+        web_store_by_handle(&g->st, arg, util_now()) != s) {
+        text(fd, "403 Forbidden", "fel session\n");
+        return;
+    }
+    respond(fd, "200 OK", NULL, NULL, NULL, 0);
+}
+
+/* The terminal wrapper's call: handle -> bokfd session. Never routed by
+   Caddy; a request that came through a proxy is refused anyway. */
+static void h_redeem(int fd, struct gate *g, const struct web_req *r)
+{
+    char handle[128];
+    struct web_session *s = NULL;
+    if (!r->forwarded_for[0] &&
+        web_form_get(r->body, r->body_len, "handle", handle,
+                     sizeof handle) == 0)
+        s = web_store_by_handle(&g->st, handle, util_now());
+    if (!s || !bokfd_alive(g, s->bokf)) {
+        text(fd, "404 Not Found", "\n");
+        return;
+    }
+    text(fd, "200 OK", s->bokf);
+}
+
+static void handle(int fd, struct gate *g, const struct web_req *r)
+{
+    size_t bl = strlen(g->base);
+    const char *rest = strncmp(r->path, g->base, bl) == 0 ? r->path + bl
+                                                            : NULL;
+    int get = strcmp(r->method, "GET") == 0 || strcmp(r->method, "HEAD") == 0;
+    int post = strcmp(r->method, "POST") == 0;
+    if (get && strcmp(r->path, "/healthz") == 0) {
+        text(fd, "200 OK", "ok\n");
+    } else if (get && strcmp(r->path, "/auth") == 0) {
+        h_auth(fd, g, r);
+    } else if (post && strcmp(r->path, "/redeem") == 0) {
+        h_redeem(fd, g, r);
+    } else if (rest && get &&
+               (!*rest || strcmp(rest, "/") == 0 ||
+                strcmp(rest, "/login") == 0)) {
+        struct web_session *s = live_session(g, r);
+        if (s)
+            to_terminal(fd, g, s, NULL);
+        else
+            login_page(fd, g, NULL, NULL);
+    } else if (rest && post && strcmp(rest, "/login") == 0) {
+        h_login_post(fd, g, r);
+    } else if (rest && get && strcmp(rest, "/logout") == 0) {
+        h_logout(fd, g, r);
+    } else {
+        text(fd, "404 Not Found", "not found\n");
+    }
+}
+
+/* --- server ------------------------------------------------------- */
+
+static int listen_on(const char *spec)
+{
+    char host[64] = "127.0.0.1";
+    int port = 7682;
+    const char *colon = strrchr(spec, ':');
+    if (colon) {
+        snprintf(host, sizeof host, "%.*s", (int)(colon - spec), spec);
+        port = atoi(colon + 1);
+    }
+    struct sockaddr_in sa;
+    memset(&sa, 0, sizeof sa);
+    sa.sin_family = AF_INET;
+    sa.sin_port = htons((unsigned short)port);
+    if (port <= 0 || port > 65535 ||
+        inet_pton(AF_INET, host, &sa.sin_addr) != 1) {
+        log_error("BOKFWEB_LISTEN must be ipv4:port, got %s", spec);
+        return -1;
+    }
+    int fd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0);
+    int one = 1;
+    if (fd < 0 ||
+        setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof one) != 0 ||
+        bind(fd, (struct sockaddr *)&sa, sizeof sa) != 0 ||
+        listen(fd, 64) != 0) {
+        log_error("cannot listen on %s: %s", spec, strerror(errno));
+        if (fd >= 0)
+            close(fd);
+        return -1;
+    }
+    return fd;
+}
+
+static void serve(int cfd, struct gate *g)
+{
+    struct timeval tv = { 5, 0 };
+    setsockopt(cfd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof tv);
+    setsockopt(cfd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof tv);
+    char buf[WEB_MAX_REQUEST + 1];
+    size_t n = 0;
+    struct web_req r;
+    for (;;) {
+        ssize_t got = recv(cfd, buf + n, sizeof buf - 1 - n, 0);
+        if (got < 0 && errno == EINTR)
+            continue;
+        if (got <= 0)
+            return; /* closed or timed out before a full request */
+        n += (size_t)got;
+        buf[n] = '\0';
+        int pr = web_parse_request(buf, n, &r);
+        if (pr == 0)
+            break;
+        if (pr < 0 || n >= sizeof buf - 1) {
+            text(cfd, "400 Bad Request", "bad request\n");
+            return;
+        }
+    }
+    handle(cfd, g, &r);
+    memset(buf, 0, n); /* the body may hold a password */
+}
+
+int main(void)
+{
+    signal(SIGPIPE, SIG_IGN);
+    const char *lvl = getenv("BOKFWEB_LOG_LEVEL");
+    log_set_level(lvl ? log_level_from_name(lvl) : LOG_INFO);
+    static struct gate g;
+    g.bokfd = getenv("BOKFD_SOCKET");
+    if (!g.bokfd || !*g.bokfd)
+        g.bokfd = "/run/bokfd/bokfd.sock";
+    g.base = getenv("BOKFWEB_BASE");
+    if (!g.base || !*g.base)
+        g.base = "/web";
+    const char *insecure = getenv("BOKFWEB_INSECURE_COOKIE");
+    g.secure = !(insecure && strcmp(insecure, "1") == 0);
+    const char *spec = getenv("BOKFWEB_LISTEN");
+    int lfd = listen_on(spec && *spec ? spec : "127.0.0.1:7682");
+    if (lfd < 0)
+        return 1;
+    log_info("bokfweb listening on %s, base %s, bokfd %s",
+             spec && *spec ? spec : "127.0.0.1:7682", g.base, g.bokfd);
+    for (;;) {
+        int cfd = accept4(lfd, NULL, NULL, SOCK_CLOEXEC);
+        if (cfd < 0) {
+            if (errno != EINTR)
+                log_warn("accept: %s", strerror(errno));
+            continue;
+        }
+        serve(cfd, &g);
+        close(cfd);
+    }
+}
diff --git a/clients/client.c b/clients/client.c
index 30f2a67..549978d 100644
--- a/clients/client.c
+++ b/clients/client.c
@@ -388,6 +388,7 @@ static int session_open(struct client_conn *c, const char *args,
     }
     *session_out = xstrdup(yyjson_get_str(s));
     yyjson_doc_free(d);
+    free(resp);
     return 0;
 }
 
diff --git a/clients/screens_bokslut.c b/clients/screens_bokslut.c
index 2328c01..acbb098 100644
--- a/clients/screens_bokslut.c
+++ b/clients/screens_bokslut.c
@@ -844,6 +844,8 @@ static void strip_markup(const char *in, struct buf *out)
 
 static void arsredovisning_save(struct app *a, const char *text)
 {
+    if (ui_web_block("Årsredovisning"))
+        return;
     const char *home = getenv("HOME");
     char def[512];
     snprintf(def, sizeof def, "%s/Downloads", home && *home ? home : ".");
diff --git a/clients/screens_reports.c b/clients/screens_reports.c
index a06e914..1077fe0 100644
--- a/clients/screens_reports.c
+++ b/clients/screens_reports.c
@@ -701,6 +701,8 @@ static void fmt_verifikationslista(struct buf *t, const struct app *a,
 
 static void eskd_save(struct app *a, const char *from, const char *to)
 {
+    if (ui_web_block("eSKD"))
+        return;
     const char *home = getenv("HOME");
     char period[8], def[512], full[512];
     snprintf(period, sizeof period, "%.4s%.2s", to, to + 5);
@@ -957,6 +959,8 @@ static void fmt_ink2(struct buf *t, const struct app *a, yyjson_val *res)
 
 static void sru_save(struct app *a)
 {
+    if (ui_web_block("SRU"))
+        return;
     const char *home = getenv("HOME");
     char def[512];
     snprintf(def, sizeof def, "%s/Downloads", home && *home ? home : ".");
diff --git a/clients/ui.c b/clients/ui.c
index 2eb2dfe..99ad213 100644
--- a/clients/ui.c
+++ b/clients/ui.c
@@ -338,6 +338,8 @@ static void expand_path(const char *in, char *out, size_t n)
    Returns a malloc'd path, or NULL on cancel. */
 char *file_browser(struct app *a, const char *start_dir)
 {
+    if (ui_web_block("Välj fil"))
+        return NULL;
     if (g_quit)
         return NULL;
     char dir[1024];
@@ -478,6 +480,27 @@ static void safe_fname(const char *in, char *out, size_t n)
     out[o] = '\0';
 }
 
+int ui_web_mode(void)
+{
+    static int mode = -1;
+    if (mode < 0) {
+        const char *v = getenv("BOKF_WEB");
+        mode = v && strcmp(v, "1") == 0;
+    }
+    return mode;
+}
+
+int ui_web_block(const char *title)
+{
+    if (!ui_web_mode())
+        return 0;
+    tui_message(title,
+                "Inte tillgängligt i webbversionen ännu: filer kan inte\n"
+                "laddas upp, sparas eller öppnas härifrån.\n"
+                "Använd bokftui på datorn för det.");
+    return 1;
+}
+
 /* Open a saved file with xdg-open when a desktop session is present;
    otherwise (or on fork failure) show where it was saved. */
 static void open_saved(const char *path, const char *title)
@@ -507,6 +530,8 @@ static void open_saved(const char *path, const char *title)
 static void save_cache_and_open(const unsigned char *data, size_t n,
                                 const char *filename, const char *title)
 {
+    if (ui_web_block(title))
+        return;
     char dir[512], path[700], safe[600];
     pdf_cache_dir(dir, sizeof dir);
     safe_fname(filename, safe, sizeof safe);
@@ -614,6 +639,8 @@ void attachment_download(struct app *a, int64_t att_id)
         tui_message("Underlag", "Kunde inte avkoda innehållet.");
         goto done;
     }
+    if (ui_web_block("Underlag"))
+        goto done;
     const char *home = getenv("HOME");
     char def[600], dl[512];
     snprintf(dl, sizeof dl, "%s/Downloads", home && *home ? home : ".");
diff --git a/clients/ui.h b/clients/ui.h
index 0fb533b..c221118 100644
--- a/clients/ui.h
+++ b/clients/ui.h
@@ -72,6 +72,12 @@ void kr_whole(int64_t ore, char *buf, size_t n);
 int parse_x_double(const char *s, double *out);
 void replace_x_into(const char *src, double x, char *dst, size_t cap);
 void app_refresh_context(struct app *a);
+/* Web mode (BOKF_WEB=1, set by the browser-terminal wrapper): the TUI runs
+   on the web frontend, not on the user's machine, so nothing may read or
+   write files there or start programs. ui_web_block() shows why and
+   returns 1 in web mode; callers return early. */
+int ui_web_mode(void);
+int ui_web_block(const char *title);
 int select_org(struct app *a);
 char *rpc_dry(struct app *a, const char *cmd, const char *args);
 char *read_file_b64(const char *path);
diff --git a/clients/web.c b/clients/web.c
new file mode 100644
index 0000000..cc70caf
--- /dev/null
+++ b/clients/web.c
@@ -0,0 +1,330 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+
+#include "web.h"
+
+/* Copies at most cap-1 bytes of [s, s+n) into out; -1 when it does not fit. */
+static int copy_n(char *out, size_t cap, const char *s, size_t n)
+{
+    if (!cap || n >= cap)
+        return -1;
+    memcpy(out, s, n);
+    out[n] = '\0';
+    return 0;
+}
+
+/* Value of header `name` (case-insensitive) in [h, end), trimmed. */
+static int header_get(const char *h, const char *end, const char *name,
+                      char *out, size_t cap)
+{
+    size_t nl = strlen(name);
+    while (h < end) {
+        const char *eol = memchr(h, '\n', (size_t)(end - h));
+        if (!eol)
+            eol = end;
+        const char *line_end = eol > h && eol[-1] == '\r' ? eol - 1 : eol;
+        if ((size_t)(line_end - h) > nl && h[nl] == ':' &&
+            strncasecmp(h, name, nl) == 0) {
+            const char *v = h + nl + 1;
+            while (v < line_end && (*v == ' ' || *v == '\t'))
+                v++;
+            const char *ve = line_end;
+            while (ve > v && (ve[-1] == ' ' || ve[-1] == '\t'))
+                ve--;
+            return copy_n(out, cap, v, (size_t)(ve - v));
+        }
+        h = eol + 1;
+    }
+    if (cap)
+        out[0] = '\0';
+    return -1;
+}
+
+int web_parse_request(const char *buf, size_t n, struct web_req *r)
+{
+    memset(r, 0, sizeof *r);
+    if (n > WEB_MAX_REQUEST)
+        return -1;
+    const char *hend = NULL;
+    for (size_t i = 0; i + 3 < n; i++)
+        if (memcmp(buf + i, "\r\n\r\n", 4) == 0) {
+            hend = buf + i + 4;
+            break;
+        }
+    if (!hend)
+        return n >= WEB_MAX_REQUEST ? -1 : 1;
+
+    /* request line: METHOD SP TARGET SP HTTP/x.y */
+    const char *sp1 = memchr(buf, ' ', (size_t)(hend - buf));
+    if (!sp1 || copy_n(r->method, sizeof r->method, buf,
+                       (size_t)(sp1 - buf)) != 0)
+        return -1;
+    const char *tgt = sp1 + 1;
+    const char *sp2 = memchr(tgt, ' ', (size_t)(hend - tgt));
+    if (!sp2 || sp2 == tgt || *tgt != '/')
+        return -1;
+    const char *q = memchr(tgt, '?', (size_t)(sp2 - tgt));
+    const char *pend = q ? q : sp2;
+    if (copy_n(r->path, sizeof r->path, tgt, (size_t)(pend - tgt)) != 0)
+        return -1;
+    if (q && copy_n(r->query, sizeof r->query, q + 1,
+                    (size_t)(sp2 - q - 1)) != 0)
+        return -1;
+    if (strncmp(sp2 + 1, "HTTP/1.", 7) != 0)
+        return -1;
+
+    const char *hdrs = memchr(sp2, '\n', (size_t)(hend - sp2));
+    if (!hdrs)
+        return -1;
+    hdrs++;
+    header_get(hdrs, hend, "Cookie", r->cookie, sizeof r->cookie);
+    header_get(hdrs, hend, "X-Forwarded-For", r->forwarded_for,
+               sizeof r->forwarded_for);
+    header_get(hdrs, hend, "X-Forwarded-Uri", r->forwarded_uri,
+               sizeof r->forwarded_uri);
+    char cl[32];
+    size_t body_len = 0;
+    if (header_get(hdrs, hend, "Content-Length", cl, sizeof cl) == 0) {
+        char *e = NULL;
+        long long v = strtoll(cl, &e, 10);
+        if (!*cl || *e || v < 0 || v > WEB_MAX_REQUEST)
+            return -1;
+        body_len = (size_t)v;
+    }
+    char te[32];
+    if (header_get(hdrs, hend, "Transfer-Encoding", te, sizeof te) == 0)
+        return -1; /* chunked bodies are not needed here */
+    size_t have = n - (size_t)(hend - buf);
+    if (have < body_len)
+        return (size_t)(hend - buf) + body_len > WEB_MAX_REQUEST ? -1 : 1;
+    r->body = hend;
+    r->body_len = body_len;
+    return 0;
+}
+
+static int hexval(char c)
+{
+    if (c >= '0' && c <= '9')
+        return c - '0';
+    if (c >= 'a' && c <= 'f')
+        return c - 'a' + 10;
+    if (c >= 'A' && c <= 'F')
+        return c - 'A' + 10;
+    return -1;
+}
+
+int web_form_get(const char *form, size_t len, const char *key, char *out,
+                 size_t cap)
+{
+    size_t kl = strlen(key);
+    const char *p = form, *end = form + len;
+    while (p < end) {
+        const char *amp = memchr(p, '&', (size_t)(end - p));
+        const char *pe = amp ? amp : end;
+        const char *eq = memchr(p, '=', (size_t)(pe - p));
+        if (eq && (size_t)(eq - p) == kl && memcmp(p, key, kl) == 0) {
+            size_t o = 0;
+            for (const char *v = eq + 1; v < pe; v++) {
+                char c = *v;
+                if (c == '+') {
+                    c = ' ';
+                } else if (c == '%') {
+                    if (pe - v < 3)
+                        return -1;
+                    int hi = hexval(v[1]), lo = hexval(v[2]);
+                    if (hi < 0 || lo < 0)
+                        return -1;
+                    c = (char)(hi * 16 + lo);
+                    if (!c)
+                        return -1;
+                    v += 2;
+                }
+                if (o + 1 >= cap)
+                    return -1;
+                out[o++] = c;
+            }
+            out[o] = '\0';
+            return 0;
+        }
+        p = pe + 1;
+    }
+    return -1;
+}
+
+int web_cookie_get(const char *header, const char *name, char *out,
+                   size_t cap)
+{
+    size_t nl = strlen(name);
+    const char *p = header;
+    while (p && *p) {
+        while (*p == ' ' || *p == ';')
+            p++;
+        const char *semi = strchr(p, ';');
+        const char *pe = semi ? semi : p + strlen(p);
+        if ((size_t)(pe - p) > nl && p[nl] == '=' &&
+            strncmp(p, name, nl) == 0)
+            return copy_n(out, cap, p + nl + 1, (size_t)(pe - p - nl - 1));
+        p = semi ? semi + 1 : NULL;
+    }
+    return -1;
+}
+
+void web_html_escape(struct buf *b, const char *s)
+{
+    for (; s && *s; s++) {
+        switch (*s) {
+        case '&':
+            buf_append(b, "&amp;", 5);
+            break;
+        case '<':
+            buf_append(b, "&lt;", 4);
+            break;
+        case '>':
+            buf_append(b, "&gt;", 4);
+            break;
+        case '"':
+            buf_append(b, "&quot;", 6);
+            break;
+        case '\'':
+            buf_append(b, "&#39;", 5);
+            break;
+        default:
+            buf_append(b, s, 1);
+        }
+    }
+}
+
+int web_token_ok(const char *s)
+{
+    if (!s || !*s)
+        return 0;
+    for (; *s; s++)
+        if (!((*s >= 'A' && *s <= 'Z') || (*s >= 'a' && *s <= 'z') ||
+              (*s >= '0' && *s <= '9') || *s == '_' || *s == '-'))
+            return 0;
+    return 1;
+}
+
+/* --- sessions ------------------------------------------------------ */
+
+static int session_live(const struct web_session *s, int64_t now)
+{
+    return s->token[0] && now - s->created < WEB_SESSION_TTL;
+}
+
+struct web_session *web_store_add(struct web_store *st, const char *bokf,
+                                  const char *user, int64_t now)
+{
+    struct web_session *slot = NULL;
+    for (int i = 0; i < WEB_MAX_SESSIONS && !slot; i++)
+        if (!session_live(&st->s[i], now))
+            slot = &st->s[i];
+    if (!slot) { /* full: replace the oldest */
+        slot = &st->s[0];
+        for (int i = 1; i < WEB_MAX_SESSIONS; i++)
+            if (st->s[i].created < slot->created)
+                slot = &st->s[i];
+    }
+    memset(slot, 0, sizeof *slot);
+    char *tok = util_random_id("", 32);
+    char *hdl = util_random_id("", 24);
+    snprintf(slot->token, sizeof slot->token, "%s", tok);
+    snprintf(slot->handle, sizeof slot->handle, "%s", hdl);
+    free(tok);
+    free(hdl);
+    snprintf(slot->bokf, sizeof slot->bokf, "%s", bokf);
+    snprintf(slot->user, sizeof slot->user, "%s", user ? user : "");
+    slot->created = now;
+    return slot;
+}
+
+static struct web_session *store_find(struct web_store *st, const char *v,
+                                      int by_handle, int64_t now)
+{
+    if (!web_token_ok(v))
+        return NULL;
+    size_t vl = strlen(v);
+    for (int i = 0; i < WEB_MAX_SESSIONS; i++) {
+        struct web_session *s = &st->s[i];
+        const char *k = by_handle ? s->handle : s->token;
+        if (session_live(s, now) && strlen(k) == vl &&
+            util_const_eq(k, v, vl))
+            return s;
+    }
+    return NULL;
+}
+
+struct web_session *web_store_by_token(struct web_store *st,
+                                       const char *token, int64_t now)
+{
+    return store_find(st, token, 0, now);
+}
+
+struct web_session *web_store_by_handle(struct web_store *st,
+                                        const char *handle, int64_t now)
+{
+    return store_find(st, handle, 1, now);
+}
+
+void web_store_del(struct web_session *s)
+{
+    if (s)
+        memset(s, 0, sizeof *s);
+}
+
+/* --- limiter ------------------------------------------------------- */
+
+static struct web_rl_entry *rl_find(struct web_rl *rl, const char *addr)
+{
+    for (int i = 0; i < WEB_RL_SLOTS; i++)
+        if (rl->e[i].addr[0] && strcmp(rl->e[i].addr, addr) == 0)
+            return &rl->e[i];
+    return NULL;
+}
+
+int64_t web_rl_blocked(const struct web_rl *rl, const char *addr,
+                       int64_t now)
+{
+    for (int i = 0; i < WEB_RL_SLOTS; i++) {
+        const struct web_rl_entry *e = &rl->e[i];
+        if (e->addr[0] && strcmp(e->addr, addr) == 0)
+            return e->fails >= WEB_RL_MAX_FAILS && e->window_end > now
+                       ? e->window_end - now
+                       : 0;
+    }
+    return 0;
+}
+
+void web_rl_fail(struct web_rl *rl, const char *addr, int64_t now)
+{
+    struct web_rl_entry *e = rl_find(rl, addr);
+    if (!e) {
+        /* a free or expired slot, else the one whose window ends first */
+        e = &rl->e[0];
+        for (int i = 0; i < WEB_RL_SLOTS; i++) {
+            struct web_rl_entry *c = &rl->e[i];
+            if (!c->addr[0] || c->window_end <= now) {
+                e = c;
+                break;
+            }
+            if (c->window_end < e->window_end)
+                e = c;
+        }
+        memset(e, 0, sizeof *e);
+        snprintf(e->addr, sizeof e->addr, "%s", addr);
+    }
+    if (e->fails == 0 || e->window_end <= now) {
+        e->fails = 0;
+        e->window_end = now + WEB_RL_WINDOW;
+    }
+    e->fails++;
+}
+
+void web_rl_ok(struct web_rl *rl, const char *addr)
+{
+    struct web_rl_entry *e = rl_find(rl, addr);
+    if (e)
+        memset(e, 0, sizeof *e);
+}
diff --git a/clients/web.h b/clients/web.h
new file mode 100644
index 0000000..a652498
--- /dev/null
+++ b/clients/web.h
@@ -0,0 +1,100 @@
+#ifndef BOKF_WEB_H
+#define BOKF_WEB_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "util.h"
+
+/* Pure parts of bokfweb, the login gate in front of the browser terminal:
+   HTTP request parsing, form and cookie decoding, HTML escaping, the
+   session store and the per-address login limiter. Unit-tested in
+   tests/test_web.c; bokfweb.c adds sockets and the bokfd calls. */
+
+#define WEB_MAX_REQUEST 8192
+
+struct web_req {
+    char method[8];
+    char path[256];  /* without the query */
+    char query[256];
+    char cookie[512];
+    char forwarded_for[64];
+    char forwarded_uri[512];
+    const char *body; /* points into the parsed buffer */
+    size_t body_len;
+};
+
+/* Parses one HTTP/1.x request in buf[0..n). Returns 0 when complete
+   (headers and Content-Length bytes of body), 1 when more bytes are
+   needed, -1 when malformed or too large. */
+int web_parse_request(const char *buf, size_t n, struct web_req *r);
+
+/* Value of key in an application/x-www-form-urlencoded string (also a
+   query string), decoded ('+' and %XX). 0 when found, -1 otherwise; a
+   value that does not fit or decodes to a NUL byte counts as not found. */
+int web_form_get(const char *form, size_t len, const char *key, char *out,
+                 size_t cap);
+
+/* Value of cookie `name` in a Cookie header. 0 when found. */
+int web_cookie_get(const char *header, const char *name, char *out,
+                   size_t cap);
+
+/* Appends s to b with & < > " ' escaped. */
+void web_html_escape(struct buf *b, const char *s);
+
+/* Whether s is a non-empty token of [A-Za-z0-9_-] only (cookie values and
+   handles are generated that way; anything else is rejected unread). */
+int web_token_ok(const char *s);
+
+/* --- sessions: cookie token -> bokfd session, plus the terminal handle */
+
+#define WEB_MAX_SESSIONS 64
+#define WEB_SESSION_TTL (12 * 3600) /* absolute; bokfd's idle TTL applies too */
+
+struct web_session {
+    char token[64];  /* the cookie value */
+    char handle[64]; /* goes into the terminal URL (?arg=) */
+    char bokf[128];  /* bokfd session id */
+    char user[64];
+    int64_t created;
+};
+
+struct web_store {
+    struct web_session s[WEB_MAX_SESSIONS];
+};
+
+/* Adds a session with fresh random token and handle; the oldest session is
+   replaced when the store is full. Returns it, or NULL when the random
+   source fails. */
+struct web_session *web_store_add(struct web_store *st, const char *bokf,
+                                  const char *user, int64_t now);
+/* The live session with this cookie token / terminal handle, or NULL. */
+struct web_session *web_store_by_token(struct web_store *st,
+                                       const char *token, int64_t now);
+struct web_session *web_store_by_handle(struct web_store *st,
+                                        const char *handle, int64_t now);
+void web_store_del(struct web_session *s);
+
+/* --- failed-login limiter per client address */
+
+#define WEB_RL_SLOTS 256
+#define WEB_RL_MAX_FAILS 5
+#define WEB_RL_WINDOW 900
+
+struct web_rl_entry {
+    char addr[64];
+    int fails;
+    int64_t window_end;
+};
+
+struct web_rl {
+    struct web_rl_entry e[WEB_RL_SLOTS];
+};
+
+/* Seconds until addr may try again, 0 when it may try now. */
+int64_t web_rl_blocked(const struct web_rl *rl, const char *addr,
+                       int64_t now);
+void web_rl_fail(struct web_rl *rl, const char *addr, int64_t now);
+void web_rl_ok(struct web_rl *rl, const char *addr);
+
+#endif
diff --git a/compose.yaml b/compose.yaml
index 25cb1eb..01825e4 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -22,6 +22,31 @@ services:
       BOKFD_TLS_CERT: /var/lib/bokfd/certs/certificates/${LEGO_DOMAIN:-bokf.makandra.eu}.crt
       BOKFD_TLS_KEY: /var/lib/bokfd/certs/certificates/${LEGO_DOMAIN:-bokf.makandra.eu}.key
 
+  # Web frontend: login gate + browser terminal on http://127.0.0.1:8790.
+  # The host's TLS proxy serves it as https://bokf.makandra.eu/web (see
+  # deploy/Caddyfile and docs/DEPLOY.md). Talks to bokfd over the socket
+  # only; read-only, no capabilities.
+  web:
+    image: ${BOKF_WEB_IMAGE:-bokf-web}:${BOKF_TAG:-latest}
+    restart: unless-stopped
+    depends_on:
+      - bokfd
+    ports:
+      - "127.0.0.1:8790:8790"
+    volumes:
+      - ./var/run:/run/bokfd
+    environment:
+      BOKF_WEB_MAX_SESSIONS: ${BOKF_WEB_MAX_SESSIONS:-20}
+    read_only: true
+    tmpfs:
+      - /tmp:size=256m,mode=1777
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    pids_limit: 512
+    mem_limit: 2g
+
   certs:
     image: goacme/lego:latest
     restart: unless-stopped
diff --git a/deploy/Caddyfile b/deploy/Caddyfile
new file mode 100644
index 0000000..c86f4e5
--- /dev/null
+++ b/deploy/Caddyfile
@@ -0,0 +1,47 @@
+# Web frontend routing inside the bokf-web container: the login gate
+# (bokfweb, 127.0.0.1:7682) and the browser terminal (ttyd, 127.0.0.1:7681).
+# Nothing reaches ttyd without the gate's OK.
+#
+# Plain HTTP on :8790, published on the host's loopback only. TLS for
+# https://bokf.makandra.eu is the host's reverse proxy (the NAS Caddy):
+#
+#     bokf.makandra.eu {
+#         tls { dns inwx ... }          # as for the other sites
+#         reverse_proxy 127.0.0.1:8790
+#     }
+{
+	auto_https off
+	admin off
+	servers {
+		# the host proxy's X-Forwarded-For names the real client (the
+		# gate limits failed logins per client address)
+		trusted_proxies static private_ranges
+	}
+}
+
+:8790 {
+	header {
+		Strict-Transport-Security "max-age=31536000"
+		-Server
+	}
+
+	redir / /web/ 302
+
+	# the terminal: only with a live login whose handle is in the URL
+	@tty path /web/tty /web/tty/*
+	handle @tty {
+		forward_auth 127.0.0.1:7682 {
+			uri /auth
+		}
+		reverse_proxy 127.0.0.1:7681
+	}
+
+	# login page, login and logout
+	handle /web* {
+		reverse_proxy 127.0.0.1:7682
+	}
+
+	handle {
+		respond "not found" 404
+	}
+}
diff --git a/deploy/Dockerfile.cross b/deploy/Dockerfile.cross
index ab0504c..a14ac0f 100644
--- a/deploy/Dockerfile.cross
+++ b/deploy/Dockerfile.cross
@@ -1,12 +1,12 @@
-# Cross-compile the static arm64 backend binaries on an amd64 host. The
-# runtime image is assembled later on the target host from the produced
-# binaries; there is no TUI in the runtime image.
+# Cross-compile the static arm64 binaries on an amd64 host: the backend
+# (bokfd, bokfctl) and the web frontend's bokftui and bokfweb. The images
+# are assembled later on the target host from the produced binaries.
 FROM debian:bookworm
 RUN dpkg --add-architecture arm64 \
  && apt-get update \
  && apt-get install -y --no-install-recommends \
       make ca-certificates gcc-aarch64-linux-gnu \
-      libc6-dev:arm64 libssl-dev:arm64 \
+      libc6-dev:arm64 libssl-dev:arm64 libncurses-dev:arm64 \
  && rm -rf /var/lib/apt/lists/*
 COPY cross-build.sh /usr/local/bin/cross-build
 RUN chmod 0755 /usr/local/bin/cross-build
diff --git a/deploy/bokftui-web b/deploy/bokftui-web
new file mode 100755
index 0000000..b6ec9b5
--- /dev/null
+++ b/deploy/bokftui-web
@@ -0,0 +1,40 @@
+#!/bin/sh
+# Started by ttyd for every browser terminal, with the terminal handle from
+# the URL (?arg=) as $1. Trades the handle for the bokfd session at the
+# gate (bokfweb /redeem, internal only), then runs bokftui already logged
+# in, in a private throwaway HOME, in web mode (no local files), with
+# resource limits. No shell is ever offered: when bokftui exits, the
+# terminal ends.
+set -u
+gate="${BOKFWEB_INTERNAL:-http://127.0.0.1:7682}"
+
+msg() {
+    printf '\r\n  %s\r\n\r\n' "$1"
+    sleep 4
+    exit 1
+}
+
+handle="${1:-}"
+case "$handle" in
+    "" | *[!A-Za-z0-9_-]*) msg "Ogiltig länk. Öppna /web/ och logga in igen." ;;
+esac
+
+session=$(wget -q -O - --post-data "handle=$handle" "$gate/redeem" 2>/dev/null) ||
+    msg "Sessionen har gått ut. Öppna /web/ och logga in igen."
+case "$session" in
+    "" | *[!A-Za-z0-9_-]*) msg "Sessionen har gått ut. Öppna /web/ och logga in igen." ;;
+esac
+
+home=$(mktemp -d /tmp/bokf-web.XXXXXXXX) || msg "Kunde inte starta sessionen."
+trap 'rm -rf "$home"' EXIT HUP INT TERM
+chmod 0700 "$home"
+
+# per-session limits: memory, CPU time, open files (the process count is
+# capped per container in compose.yaml: every session runs as one uid)
+ulimit -v 524288 2>/dev/null || true
+ulimit -t 7200 2>/dev/null || true
+ulimit -n 256 2>/dev/null || true
+
+HOME="$home" XDG_CONFIG_HOME="$home/.config" XDG_CACHE_HOME="$home/.cache" \
+BOKF_WEB=1 BOKFD_SESSION="$session" \
+    bokftui --socket "${BOKFD_SOCKET:-/run/bokfd/bokfd.sock}"
diff --git a/deploy/cross-build.sh b/deploy/cross-build.sh
index 19d07b7..54a2929 100644
--- a/deploy/cross-build.sh
+++ b/deploy/cross-build.sh
@@ -1,16 +1,20 @@
 #!/bin/sh
-# Cross-compile the static aarch64 backend binaries (bokfd, bokfctl).
+# Cross-compile the static aarch64 binaries: bokfd, bokfctl and, for the
+# web image, bokftui and bokfweb.
 # Expects the source read-only at /src, writes the binaries to /out and takes
 # the version from $VERSION. Run through deploy/Dockerfile.cross. OpenSSL and
 # glibc are linked statically, so the Alpine runtime image needs no shared
 # libraries (the kernel ABI is all that matters).
 set -eu
 
-make -C /src -j"$(nproc)" BUILD=/tmp/build backend \
+# ncursesw needs its tinfo half spelled out for a static link
+make -C /src -j"$(nproc)" BUILD=/tmp/build \
+    backend /tmp/build/bokftui /tmp/build/bokfweb \
     CC=aarch64-linux-gnu-gcc \
     CFLAGS="-O2 -g -static -L/usr/lib/aarch64-linux-gnu" \
-    SSL_LIBS="-l:libssl.a -l:libcrypto.a -ldl -lpthread" \
+    SSL_LIBS="-l:libssl.a -l:libcrypto.a -l:libtinfo.a -ldl -lpthread" \
     VERSION="${VERSION:-0.1.0-dev}"
 
 mkdir -p /out
-cp /tmp/build/bokfd /tmp/build/bokfctl /out/
+cp /tmp/build/bokfd /tmp/build/bokfctl /tmp/build/bokftui \
+   /tmp/build/bokfweb /out/
diff --git a/deploy/web-entrypoint.sh b/deploy/web-entrypoint.sh
new file mode 100755
index 0000000..38e07f9
--- /dev/null
+++ b/deploy/web-entrypoint.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+# Web frontend container: bokfweb (login gate), ttyd (browser terminal)
+# and Caddy (routing on :8790, behind the host's TLS proxy). The gate and
+# ttyd listen on 127.0.0.1 only. Each helper is restarted if it dies; Caddy
+# is the main process, so the container stops (and compose restarts it)
+# when Caddy does.
+set -eu
+
+export BOKFD_SOCKET="${BOKFD_SOCKET:-/run/bokfd/bokfd.sock}"
+export XDG_DATA_HOME=/tmp/caddy-data XDG_CONFIG_HOME=/tmp/caddy-config
+
+keep() {
+    while :; do
+        "$@" || true
+        echo "web: $1 exited, restarting" >&2
+        sleep 1
+    done
+}
+
+keep bokfweb &
+keep ttyd -i 127.0.0.1 -p 7681 -b /web/tty -a -W -O \
+    -m "${BOKF_WEB_MAX_SESSIONS:-20}" \
+    -t titleFixed=bokf -t fontSize=15 -t disableLeaveAlert=true \
+    bokftui-web &
+
+exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
diff --git a/docs/DECISIONS.md b/docs/DECISIONS.md
index c18f49b..e317758 100644
--- a/docs/DECISIONS.md
+++ b/docs/DECISIONS.md
@@ -275,6 +275,20 @@ kept verbatim from the STATE.md they were pruned from (2026-09-21).
     the key parts of #11 and #28; `make check` rejects F-keys, `^N` and
     `^Enter` in `clients/`.
 
+30. **Web frontend (2026-09-23)**: bokftui runs in the browser through
+    ttyd in its own container (`bokf-web`), behind a login gate in C
+    (`bokfweb`) that authenticates with bokfd's `session.open` — no second
+    password store — and one login: the gate hands the bokfd session to
+    the TUI through a terminal handle that only works with the login's
+    cookie. Caddy in the container does the routing and `forward_auth`;
+    TLS stays with the host's existing Caddy (port 443 was taken), which
+    proxies `bokf.makandra.eu` to `127.0.0.1:8790`. Every terminal is an
+    isolated process (private HOME, limits, `BOKF_WEB=1`: no local files or
+    programs). bokfd's login limiter became per user name (it was one
+    global counter, so any 5 wrong guesses locked out everybody) and the
+    gate limits per client address. Audience: the owner and Petter first,
+    prepared for more users.
+
 ## Completed work formerly listed under "Pending decisions"
 
 - Attachments are complete: download (voucher detail `f`, Underlag `Enter`,
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
index 6fe6a53..99b7661 100644
--- a/docs/DEPLOY.md
+++ b/docs/DEPLOY.md
@@ -224,6 +224,66 @@ Agents use `token.create` instead of a password; tokens are scoped and
 revocable. Only the TLS port is forwarded, and every command still requires
 authentication (`meta` and `health` excepted).
 
+## Web frontend (`https://bokf.makandra.eu/web`)
+
+The `web` service (image `bokf-web`, built from the `web` target of the
+same Dockerfile and shipped by `scripts/deploy.sh` with the daemon) serves
+bokftui in the browser:
+
+```
+browser ──443──▶ host Caddy (TLS) ──▶ 127.0.0.1:8790  bokf-web container
+                                        Caddy: routing + forward_auth
+                                        ├─ /web, /web/login, /web/logout ─▶ bokfweb (login gate)
+                                        └─ /web/tty/* (gate OK only) ────▶ ttyd ─▶ bokftui-web ─▶ bokftui
+                                                                                    │
+                                                              bokfd ◀── unix socket ┘
+```
+
+- **Login gate** (`bokfweb`, `clients/bokfweb.c`): the login page checks
+  the credentials with bokfd's own `session.open` — there is no second
+  password store, and bokfd's audit and per-user lockout apply. The gate
+  limits failed logins per client address (5 per 15 min) before bokfd's
+  limit is reached. A login sets a cookie (`HttpOnly`, `Secure`,
+  `SameSite=Strict`, 12 h) and redirects to `/web/tty/?arg=<handle>`.
+- **One login**: the terminal wrapper (`deploy/bokftui-web`) trades the
+  handle for the bokfd session on the gate's internal `/redeem` (never
+  routed by Caddy) and starts `bokftui` with `BOKFD_SESSION`, so the TUI
+  opens logged in. Caddy's `forward_auth` lets a request reach ttyd only
+  with a live cookie whose session owns the handle in the URL; a leaked
+  URL is useless without the cookie. Quitting the TUI (or `/web/logout`)
+  closes the bokfd session and with it the web session.
+- **Isolation**: every browser terminal is its own bokftui process with a
+  private throwaway `HOME` (config, drafts, log), memory/CPU/file limits,
+  and `BOKF_WEB=1`: the TUI refuses everything that would read or write
+  files or start programs on the frontend (file browser, save prompts,
+  downloads, the PDF viewer). No shell is ever offered. The container runs
+  as uid 10001, read-only root, `/tmp` tmpfs, all capabilities dropped,
+  `no-new-privileges`, pids/memory limits, and it sees bokfd only through
+  the protocol socket (no database, no secrets, no certificates).
+- **TLS** is the host's reverse proxy. On the NAS, add to the existing
+  Caddy (`/mnt/data/caddy/Caddyfile`) a site block like the others and
+  reload it:
+
+  ```
+  bokf.makandra.eu {
+      tls {
+          dns inwx { ... }        # as for the other sites
+      }
+      reverse_proxy 127.0.0.1:8790
+  }
+  ```
+
+  Port 443 is already forwarded for the other sites. The container
+  publishes 8790 on the host's loopback only, so it is unreachable until
+  that block exists.
+- `BOKF_WEB_MAX_SESSIONS` (default 20) caps concurrent terminals.
+  `docker compose logs web` shows logins, logouts and failed attempts
+  (never passwords).
+
+Not yet in the web version: uploading and downloading files (attachments,
+bank files, SRU/eSKD/årsredovisning files, PDFs). The TUI says so where it
+applies; use bokftui on a computer for those.
+
 ## Mock company
 
 ```sh
diff --git a/docs/PROTOCOL.md b/docs/PROTOCOL.md
index 709a475..3c8ba54 100644
--- a/docs/PROTOCOL.md
+++ b/docs/PROTOCOL.md
@@ -85,7 +85,11 @@ and returns an opaque, high-entropy session id:
   intentional. API tokens survive restarts.
 - Sliding TTL, `session_ttl` default 8 h. `session.close` ends one explicitly.
 - Passwords are stored as Argon2id hashes. Failed logins are rate limited per
-  peer (default: 5 failures per 15 minutes, then `RATE_LIMITED`).
+  user name (5 failures per 15 minutes, then `RATE_LIMITED` for that name
+  only): guessing one account never locks out the others. The table of
+  counters replaces expired or least-failed entries when full, so flooding
+  it with names neither disables the limiter nor lifts a block. The web
+  gate (`bokfweb`) adds its own limit per client address in front of this.
 - A user changes their own password with `user.set_password` from a
   password session (a token session gets `FORBIDDEN`). The current password
   is required — 5 wrong ones per 15 minutes give `RATE_LIMITED` — and the
@@ -946,7 +950,10 @@ commands. Implemented screens (0.1.0-dev):
 
 - **Inloggning** — server, user, password; org picker when several exist.
   **Byt bolag** in the main menu reopens the picker during the session;
-  **Byt lösenord** calls `user.set_password`.
+  **Byt lösenord** calls `user.set_password`. The same TUI runs in the
+  browser at `/web` (DEPLOY.md "Web frontend"): the login page opens the
+  session with `session.open` and the TUI reuses it; file features are
+  off there.
 - **Dashboard** — status line with org, fiscal year, role and user.
 - **Verifikat** — list and detail view (rows with column headers, an
   underlag section separated by a rule, hash, link to corrected voucher); `c`
@@ -1122,7 +1129,7 @@ beyond the session and calls nothing but public commands.
 | `session_ttl` | `8h` | sliding session lifetime |
 | `max_line_bytes` | `1048576` | NDJSON line limit |
 | `max_attachment_bytes` | `10485760` (10 MiB) | decoded attachment limit |
-| `auth_fail_limit` | `5/15m` | login rate limit per peer |
+| `auth_fail_limit` | `5/15m` | login rate limit per user name (fixed in the code) |
 | `synchronous` | `FULL` | SQLite durability (`FULL`/`NORMAL`) |
 | `audit_reads` | `false` | log read commands too |
 | `allow_org_create` | `true` | any user may create an org |
diff --git a/docs/STATE.md b/docs/STATE.md
index 77ef9a4..93ade1e 100644
--- a/docs/STATE.md
+++ b/docs/STATE.md
@@ -14,6 +14,16 @@ unit tests and the docs consistency check.
 
 ## Resume here (2026-09-23)
 
+- **Web frontend (2026-09-23, branch `feat/web-frontend`, not deployed)**:
+  image `bokf-web` (Caddy routing + `bokfweb` login gate + ttyd +
+  bokftui in web mode) as compose service `web` on `127.0.0.1:8790`; see
+  DEPLOY.md "Web frontend" and decision #30. Tested end to end locally
+  (login, one-login handoff, foreign handle 403, logout, per-address
+  limit) and the aarch64 static build. **To go live**: deploy, then add
+  the `bokf.makandra.eu` block to the NAS Caddy
+  (`/mnt/data/caddy/Caddyfile`) and reload it. bokfd's login limiter is
+  now per user name (was global: 5 wrong guesses locked out everyone).
+  Next: file upload/download through the browser for the web mode.
 - **Context menu and web-safe keys (2026-09-23, branch
   `eff/context-menu`)**: `→` (or `^O`, also in table cells) opens
   "Åtgärder", a box at the right edge with every action of the view and
diff --git a/docs/TUI-GUIDELINES.md b/docs/TUI-GUIDELINES.md
index 650f026..c223514 100644
--- a/docs/TUI-GUIDELINES.md
+++ b/docs/TUI-GUIDELINES.md
@@ -145,6 +145,13 @@ terminal and browser delivers (checked by `make check`):
   reload — `^R` is a developer convenience and never the only way).
 - Every action is reachable with arrows + `Enter` through the menu; a
   letter accelerator is a shortcut, never the only path.
+- **Web mode** (`BOKF_WEB=1`, set by the browser-terminal wrapper): the TUI
+  runs on the web frontend, not on the user's machine, so a screen never
+  reads or writes a local file or starts a program there. Every such path
+  goes through `ui_web_block(title)` (`clients/ui.c`), which shows why and
+  returns 1: the file browser, `save_cache_and_open` (PDF viewer), the
+  attachment download and the SRU/eSKD/årsredovisning save prompts. New
+  file features must call it too (pty scenario `web-mode`).
 
 ### Implementation status
 
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index b625ac5..29e477f 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -143,19 +143,29 @@ if [ "$DEV" = 1 ]; then
     exit 1
 fi
 
+# Two images from one Dockerfile: bokf (the daemon, the last stage) and
+# bokf-web (the web frontend, target "web").
 if [ "$BOKF_BUILD" = local ]; then
-    echo "deploy: building image bokf:$TAG locally"
+    echo "deploy: building images bokf:$TAG and bokf-web:$TAG locally"
     docker build --build-arg "VERSION=$TAG" -t "bokf:$TAG" .
-    echo "deploy: shipping image to $BOKF_HOST"
-    docker save "bokf:$TAG" | gzip | "${SSH[@]}" 'gunzip | docker load'
+    docker build --build-arg "VERSION=$TAG" --target web \
+        -t "bokf-web:$TAG" .
+    echo "deploy: shipping images to $BOKF_HOST"
+    docker save "bokf:$TAG" "bokf-web:$TAG" | gzip |
+        "${SSH[@]}" 'gunzip | docker load'
 else
     cross_build
-    echo "deploy: assembling image bokf:$TAG on $BOKF_HOST"
-    tar -cf - \
-        --exclude=./.git --exclude=./build --exclude=./var --exclude=./.env \
-        --exclude='./*.se' --exclude='./*.db' --exclude='./*.db-wal' \
-        --exclude='./*.db-shm' --exclude=./docs . |
+    source_tar() {
+        tar -cf - \
+            --exclude=./.git --exclude=./build --exclude=./var \
+            --exclude=./.env --exclude='./*.se' --exclude='./*.db' \
+            --exclude='./*.db-wal' --exclude='./*.db-shm' --exclude=./docs .
+    }
+    echo "deploy: assembling images bokf:$TAG and bokf-web:$TAG on $BOKF_HOST"
+    source_tar |
         "${SSH[@]}" "docker build --build-arg 'VERSION=$TAG' -t 'bokf:$TAG' -"
+    source_tar |
+        "${SSH[@]}" "docker build --build-arg 'VERSION=$TAG' --target web -t 'bokf-web:$TAG' -"
     rm -rf .prebuilt
 fi
 
@@ -182,6 +192,18 @@ remote "cd '$BOKF_REMOTE_DIR' && docker compose up -d --no-build"
 
 if wait_healthy; then
     echo "deploy: bokf:$TAG is healthy on $BOKF_HOST"
+    web=""
+    for _ in $(seq 1 15); do
+        web="$(remote "cd '$BOKF_REMOTE_DIR' && docker inspect --format '{{.State.Health.Status}}' \$(docker compose ps -q web) 2>/dev/null" || true)"
+        [ "$web" = healthy ] && break
+        sleep 2
+    done
+    if [ "$web" = healthy ]; then
+        echo "deploy: bokf-web:$TAG is healthy (http://127.0.0.1:8790 on the host)"
+    else
+        echo "deploy: warning: bokf-web is '${web:-not running}'" >&2
+        remote "cd '$BOKF_REMOTE_DIR' && docker compose logs --tail=20 web" >&2 || true
+    fi
     exit 0
 fi
 
diff --git a/scripts/tui-golden.py b/scripts/tui-golden.py
index bce00eb..deca6ef 100755
--- a/scripts/tui-golden.py
+++ b/scripts/tui-golden.py
@@ -709,6 +709,31 @@ SCENARIOS = [
         ],
     },
     {
+        # Web mode (the browser-terminal wrapper sets BOKF_WEB=1): nothing
+        # may touch the frontend's files or start a viewer there.
+        "name": "web-mode",
+        "screen": "vouchers",
+        "env": {"BOKF_WEB": "1"},
+        "steps": [
+            {
+                "keys": ["home", "enter"],
+                "expect": ["Golden verifikat", "a = bifoga"],
+            },
+            {
+                "keys": ["a"],
+                "expect": ["Inte tillgängligt i webbversionen"],
+            },
+            {
+                "keys": ["enter", "f", "enter", "right", "enter"],
+                "expect": ["Inte tillgängligt i webbversionen"],
+            },
+            {
+                "keys": ["enter"],
+                "expect": ["Underlag"],
+            },
+        ],
+    },
+    {
         # Keep last: changes the rig's login password, then restores it so
         # a rerun of the list still logs in.
         "name": "change-password",
@@ -1362,7 +1387,9 @@ def main(argv):
                         "--socket", str(sock), "--user", "admin",
                         "--org", str(org_id), "--fy", str(fy["id"]),
                         "--screen", sc["screen"]]
-            app = PtyApp(argv_tui, env, TERM_COLS, TERM_ROWS)
+            sc_env = dict(env)
+            sc_env.update(sc.get("env", {}))
+            app = PtyApp(argv_tui, sc_env, TERM_COLS, TERM_ROWS)
             name = sc["name"]
             missing = None
             before = current = ""
diff --git a/src/cmd_auth.c b/src/cmd_auth.c
index 86dab12..502057c 100644
--- a/src/cmd_auth.c
+++ b/src/cmd_auth.c
@@ -18,38 +18,33 @@
 /* login rate limiting (in-memory, per key)                            */
 /* ------------------------------------------------------------------ */
 
-#define RL_MAX_KEYS 16
+/* Keyed per user name ("u:<name>") and per user for password changes
+   ("pw:<id>"): wrong guesses lock the guessed account, never everybody.
+   A full table reuses an expired entry, else the least-failed one, so the
+   limiter never switches itself off. */
+#define RL_MAX_KEYS 1024
 #define RL_MAX_FAILS 5
 #define RL_WINDOW 900
 
 struct rl_entry {
-    char key[64];
+    char key[80];
     int fails;
     int64_t window_end;
 };
 
 static struct rl_entry g_rl[RL_MAX_KEYS];
 
-static struct rl_entry *rl_get(const char *key, int create)
+static struct rl_entry *rl_find(const char *key)
 {
-    struct rl_entry *slot = NULL;
-    for (size_t i = 0; i < RL_MAX_KEYS; i++) {
+    for (size_t i = 0; i < RL_MAX_KEYS; i++)
         if (g_rl[i].key[0] && strcmp(g_rl[i].key, key) == 0)
             return &g_rl[i];
-        if (create && !g_rl[i].key[0] && !slot)
-            slot = &g_rl[i];
-    }
-    if (create && slot) {
-        snprintf(slot->key, sizeof slot->key, "%s", key);
-        slot->fails = 0;
-        slot->window_end = 0;
-    }
-    return slot;
+    return NULL;
 }
 
 static int rl_blocked(const char *key, int64_t *retry_after)
 {
-    struct rl_entry *e = rl_get(key, 0);
+    struct rl_entry *e = rl_find(key);
     if (!e || e->fails < RL_MAX_FAILS)
         return 0;
     int64_t now = util_now();
@@ -62,22 +57,38 @@ static int rl_blocked(const char *key, int64_t *retry_after)
 
 static void rl_fail(const char *key)
 {
-    struct rl_entry *e = rl_get(key, 1);
-    if (!e)
-        return;
     int64_t now = util_now();
-    if (e->fails == 0 || e->window_end <= now)
+    struct rl_entry *e = rl_find(key);
+    if (!e) {
+        /* a free or expired slot, else the one with the fewest failures
+           (a blocked entry is replaced last, so flooding the table with
+           names does not lift a block) */
+        e = &g_rl[0];
+        for (size_t i = 0; i < RL_MAX_KEYS; i++) {
+            struct rl_entry *c = &g_rl[i];
+            if (!c->key[0] || c->window_end <= now) {
+                e = c;
+                break;
+            }
+            if (c->fails < e->fails ||
+                (c->fails == e->fails && c->window_end < e->window_end))
+                e = c;
+        }
+        memset(e, 0, sizeof *e);
+        snprintf(e->key, sizeof e->key, "%s", key);
+    }
+    if (e->fails == 0 || e->window_end <= now) {
+        e->fails = 0;
         e->window_end = now + RL_WINDOW;
+    }
     e->fails++;
 }
 
 static void rl_ok(const char *key)
 {
-    struct rl_entry *e = rl_get(key, 0);
-    if (e) {
-        e->fails = 0;
-        e->window_end = 0;
-    }
+    struct rl_entry *e = rl_find(key);
+    if (e)
+        memset(e, 0, sizeof *e);
 }
 
 /* ------------------------------------------------------------------ */
@@ -188,7 +199,9 @@ static yyjson_mut_val *h_session_open(struct req *r)
             return fail(r, "INVALID_ARGS", "username and password are required");
         }
         int64_t retry = 0;
-        if (rl_blocked("local", &retry)) {
+        char rlkey[80];
+        snprintf(rlkey, sizeof rlkey, "u:%s", username);
+        if (rl_blocked(rlkey, &retry)) {
             free(reqjson);
             return failf(r, "RATE_LIMITED",
                          "too many failed logins, retry in %lld seconds",
@@ -202,14 +215,14 @@ static yyjson_mut_val *h_session_open(struct req *r)
                  auth_verify_password(pwhash, password) == 0;
         free(pwhash);
         if (!ok) {
-            rl_fail("local");
+            rl_fail(rlkey);
             audit_append(r->db, 0, uid > 0 ? uid : 0, 0, "auth.fail", reqjson,
                          "AUTH_FAILED", NULL);
             free(display);
             free(reqjson);
             return fail(r, "AUTH_FAILED", "invalid credentials");
         }
-        rl_ok("local");
+        rl_ok(rlkey);
         int64_t active = 0;
         yyjson_mut_val *orgs =
             orgs_for_user(r->db, r->rdoc, uid, 0, &active);
diff --git a/tests/test_core.c b/tests/test_core.c
index 6376517..a82c833 100644
--- a/tests/test_core.c
+++ b/tests/test_core.c
@@ -4904,7 +4904,15 @@ static void test_rate_limit(struct tctx *t)
     (void)t;
     yyjson_doc *d;
 
-    /* rate limiting must stay last: it blocks the login key */
+    CHECK(login("admin", "secret123"));
+    d = call(reqf("{\"v\":1,\"id\":\"31\",\"cmd\":\"user.create\","
+                  "\"session\":\"%s\",\"args\":{\"username\":\"rluser\","
+                  "\"password\":\"rlpassword1\"}}",
+                  g_session));
+    CHECK_OK(d);
+    yyjson_doc_free(d);
+
+    /* rate limiting must stay last: it blocks the admin login */
     for (int i = 0; i < 5; i++)
         CHECK(!login("admin", "wrong"));
     d = call("{\"v\":1,\"id\":\"32\",\"cmd\":\"session.open\",\"args\":"
@@ -4912,6 +4920,26 @@ static void test_rate_limit(struct tctx *t)
              "\"password\":\"secret123\"}}");
     CHECK_STR(d, "error.code", "RATE_LIMITED");
     yyjson_doc_free(d);
+    /* the limit is per user name: guessing one account never locks out
+       the others (a public login page must not be a lockout switch) */
+    for (int i = 0; i < 5; i++)
+        CHECK(!login("nobody-here", "wrong"));
+    CHECK(login("rluser", "rlpassword1"));
+    /* flooding the table with names neither frees admin early nor turns
+       the limiter off */
+    char name[32];
+    for (int i = 0; i < 1100; i++) {
+        snprintf(name, sizeof name, "flood%d", i);
+        login(name, "x");
+    }
+    d = call("{\"v\":1,\"id\":\"33\",\"cmd\":\"session.open\",\"args\":"
+             "{\"method\":\"password\",\"username\":\"admin\","
+             "\"password\":\"secret123\"}}");
+    CHECK_STR(d, "error.code", "RATE_LIMITED");
+    yyjson_doc_free(d);
+    for (int i = 0; i < 5; i++)
+        CHECK(!login("rluser", "wrong"));
+    CHECK(!login("rluser", "rlpassword1"));
 }
 
 static void test_employees(struct tctx *t)
diff --git a/tests/test_web.c b/tests/test_web.c
new file mode 100644
index 0000000..c5a3bea
--- /dev/null
+++ b/tests/test_web.c
@@ -0,0 +1,175 @@
+/* Unit tests for the pure parts of bokfweb (clients/web.c). */
+#include <stdio.h>
+#include <string.h>
+
+#include "util.h"
+#include "web.h"
+
+static int failures = 0;
+static int checks = 0;
+
+#define CHECK(cond)                                                     \
+    do {                                                                \
+        checks++;                                                       \
+        if (!(cond)) {                                                  \
+            failures++;                                                 \
+            fprintf(stderr, "FAIL %s:%d: %s\n", __FILE__, __LINE__,     \
+                    #cond);                                             \
+        }                                                               \
+    } while (0)
+
+static int parse(const char *s, struct web_req *r)
+{
+    return web_parse_request(s, strlen(s), r);
+}
+
+static void test_parse(void)
+{
+    struct web_req r;
+    CHECK(parse("GET /web/ HTTP/1.1\r\nHost: x\r\n\r\n", &r) == 0);
+    CHECK(strcmp(r.method, "GET") == 0 && strcmp(r.path, "/web/") == 0);
+    CHECK(r.query[0] == '\0' && r.body_len == 0);
+
+    const char *post = "POST /web/login?next=1 HTTP/1.1\r\n"
+                       "content-length: 27\r\n"
+                       "Cookie: a=1; bokf_web=tok_EN-9\r\n"
+                       "X-Forwarded-For:  203.0.113.7 \r\n\r\n"
+                       "username=anna&password=x%21";
+    CHECK(parse(post, &r) == 0);
+    CHECK(strcmp(r.path, "/web/login") == 0);
+    CHECK(strcmp(r.query, "next=1") == 0);
+    CHECK(strcmp(r.forwarded_for, "203.0.113.7") == 0);
+    CHECK(r.body_len == 27 && strncmp(r.body, "username=", 9) == 0);
+
+    /* incomplete: headers or body still coming */
+    CHECK(parse("GET / HTTP/1.1\r\nHost: x\r\n", &r) == 1);
+    CHECK(parse("POST /l HTTP/1.1\r\nContent-Length: 10\r\n\r\nabc", &r) == 1);
+    /* malformed */
+    CHECK(parse("GET\r\n\r\n", &r) == -1);
+    CHECK(parse("GET nopath HTTP/1.1\r\n\r\n", &r) == -1);
+    CHECK(parse("GET / FTP/1.0\r\n\r\n", &r) == -1);
+    CHECK(parse("POST / HTTP/1.1\r\nContent-Length: -1\r\n\r\n", &r) == -1);
+    CHECK(parse("POST / HTTP/1.1\r\nContent-Length: 99999\r\n\r\n", &r) ==
+          -1);
+    CHECK(parse("POST / HTTP/1.1\r\nTransfer-Encoding: chunked\r\n\r\n",
+                &r) == -1);
+    char big[WEB_MAX_REQUEST + 16];
+    memset(big, 'a', sizeof big);
+    memcpy(big, "GET /", 5);
+    CHECK(web_parse_request(big, sizeof big, &r) == -1);
+    /* a path longer than the field is refused, not truncated */
+    char lp[400] = "GET /";
+    memset(lp + 5, 'p', 300);
+    strcpy(lp + 305, " HTTP/1.1\r\n\r\n");
+    CHECK(parse(lp, &r) == -1);
+}
+
+static void test_form_cookie(void)
+{
+    char v[64];
+    const char *f = "username=anna+b&password=p%C3%A5ss%26x&empty=";
+    CHECK(web_form_get(f, strlen(f), "username", v, sizeof v) == 0 &&
+          strcmp(v, "anna b") == 0);
+    CHECK(web_form_get(f, strlen(f), "password", v, sizeof v) == 0 &&
+          strcmp(v, "p\xc3\xa5ss&x") == 0);
+    CHECK(web_form_get(f, strlen(f), "empty", v, sizeof v) == 0 &&
+          v[0] == '\0');
+    CHECK(web_form_get(f, strlen(f), "user", v, sizeof v) == -1);
+    CHECK(web_form_get("a=%2", 4, "a", v, sizeof v) == -1);
+    CHECK(web_form_get("a=%zz", 5, "a", v, sizeof v) == -1);
+    CHECK(web_form_get("a=%00", 5, "a", v, sizeof v) == -1);
+    CHECK(web_form_get("a=12345", 7, "a", v, 4) == -1); /* does not fit */
+    /* the body is not NUL-terminated: len bounds it */
+    CHECK(web_form_get("a=1&b=2XXXX", 7, "b", v, sizeof v) == 0 &&
+          strcmp(v, "2") == 0);
+
+    CHECK(web_cookie_get("a=1; bokf_web=tok; c=3", "bokf_web", v,
+                         sizeof v) == 0 &&
+          strcmp(v, "tok") == 0);
+    CHECK(web_cookie_get("xbokf_web=tok", "bokf_web", v, sizeof v) == -1);
+    CHECK(web_cookie_get("", "bokf_web", v, sizeof v) == -1);
+
+    CHECK(web_token_ok("aZ09_-"));
+    CHECK(!web_token_ok(""));
+    CHECK(!web_token_ok("a b"));
+    CHECK(!web_token_ok("a;b"));
+
+    struct buf b;
+    buf_init(&b);
+    web_html_escape(&b, "<a href=\"x\">&'</a>");
+    buf_append(&b, "", 1);
+    CHECK(strcmp((char *)b.p,
+                 "&lt;a href=&quot;x&quot;&gt;&amp;&#39;&lt;/a&gt;") == 0);
+    buf_free(&b);
+}
+
+static void test_store(void)
+{
+    static struct web_store st;
+    memset(&st, 0, sizeof st);
+    struct web_session *s = web_store_add(&st, "s_bokfd1", "anna", 1000);
+    CHECK(s && web_token_ok(s->token) && web_token_ok(s->handle));
+    CHECK(strcmp(s->token, s->handle) != 0);
+    char tok[64], hdl[64];
+    snprintf(tok, sizeof tok, "%s", s->token);
+    snprintf(hdl, sizeof hdl, "%s", s->handle);
+    CHECK(web_store_by_token(&st, tok, 1001) == s);
+    CHECK(web_store_by_handle(&st, hdl, 1001) == s);
+    /* token and handle are not interchangeable */
+    CHECK(web_store_by_token(&st, hdl, 1001) == NULL);
+    CHECK(web_store_by_handle(&st, tok, 1001) == NULL);
+    CHECK(web_store_by_token(&st, "nope", 1001) == NULL);
+    CHECK(web_store_by_token(&st, "bad;value", 1001) == NULL);
+    /* absolute expiry */
+    CHECK(web_store_by_token(&st, tok, 1000 + WEB_SESSION_TTL) == NULL);
+    web_store_del(s);
+    CHECK(web_store_by_token(&st, tok, 1001) == NULL);
+
+    /* a full store replaces the oldest session */
+    for (int i = 0; i < WEB_MAX_SESSIONS; i++)
+        web_store_add(&st, "x", "u", 2000 + i);
+    struct web_session *n = web_store_add(&st, "new", "u", 5000);
+    CHECK(n && strcmp(n->bokf, "new") == 0);
+    int oldest_gone = 1;
+    for (int i = 0; i < WEB_MAX_SESSIONS; i++)
+        if (st.s[i].created == 2000)
+            oldest_gone = 0;
+    CHECK(oldest_gone);
+}
+
+static void test_rl(void)
+{
+    static struct web_rl rl;
+    memset(&rl, 0, sizeof rl);
+    for (int i = 0; i < WEB_RL_MAX_FAILS - 1; i++)
+        web_rl_fail(&rl, "203.0.113.7", 100);
+    CHECK(web_rl_blocked(&rl, "203.0.113.7", 100) == 0);
+    web_rl_fail(&rl, "203.0.113.7", 100);
+    CHECK(web_rl_blocked(&rl, "203.0.113.7", 100) == WEB_RL_WINDOW);
+    /* other addresses are not affected */
+    CHECK(web_rl_blocked(&rl, "198.51.100.1", 100) == 0);
+    /* the window ends */
+    CHECK(web_rl_blocked(&rl, "203.0.113.7", 100 + WEB_RL_WINDOW) == 0);
+    web_rl_fail(&rl, "203.0.113.7", 100 + WEB_RL_WINDOW);
+    CHECK(web_rl_blocked(&rl, "203.0.113.7", 100 + WEB_RL_WINDOW) == 0);
+    /* success clears */
+    web_rl_ok(&rl, "203.0.113.7");
+    CHECK(web_rl_blocked(&rl, "203.0.113.7", 101) == 0);
+    /* many addresses: the table never overflows */
+    char a[32];
+    for (int i = 0; i < WEB_RL_SLOTS * 2; i++) {
+        snprintf(a, sizeof a, "10.0.%d.%d", i / 256, i % 256);
+        web_rl_fail(&rl, a, 200);
+    }
+    CHECK(web_rl_blocked(&rl, a, 200) == 0);
+}
+
+int main(void)
+{
+    test_parse();
+    test_form_cookie();
+    test_store();
+    test_rl();
+    printf("test_web: %d checks, %d failures\n", checks, failures);
+    return failures ? 1 : 0;
+}