1. Password reset tokens: use crypto/rand instead of math/rand 2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies 3. Cleanup: purge failed login attempts older than 24 hours 4. JWT secret: validate minimum 32 character length on startup Updated .env.example with TRUSTED_PROXIES setting |
||
|---|---|---|
| .. | ||
| cmd/server | ||
| internal | ||
| .env | ||
| .env.example | ||
| go.mod | ||
| go.sum | ||