1. Password reset tokens: use crypto/rand instead of math/rand 2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies 3. Cleanup: purge failed login attempts older than 24 hours 4. JWT secret: validate minimum 32 character length on startup Updated .env.example with TRUSTED_PROXIES setting |
||
|---|---|---|
| .. | ||
| aliases.go | ||
| auth.go | ||
| domains.go | ||
| logs.go | ||
| middleware.go | ||
| queue.go | ||
| response.go | ||
| stats.go | ||
| users.go | ||