chaas/imc-vibe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security fixes

Browse source 
1. Password reset tokens: use crypto/rand instead of math/rand
2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies
3. Cleanup: purge failed login attempts older than 24 hours
4. JWT secret: validate minimum 32 character length on startup

Updated .env.example with TRUSTED_PROXIES setting
This commit is contained in:
Christoph Haas 2026-03-23 01:09:26 +01:00
parent ccaa1eca7e
commit 269fb6f53a
6 changed files with 82 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

2
backend/internal/api/router.go
View file

@ -27,7 +27,7 @@ func New(database *db.DB, cfg *config.Config) *Router {
emailService := mail.NewEmailService(cfg)
r := &Router{
authHandler: handlers.NewAuthHandler(database, jwtManager, emailService),
authHandler: handlers.NewAuthHandler(database, jwtManager, emailService, cfg.TrustedProxies),
domainHandler: handlers.NewDomainHandler(database),
userHandler: handlers.NewUserHandler(database),
aliasHandler: handlers.NewAliasHandler(database),