imc-vibe/backend/internal/api/handlers
Christoph Haas 269fb6f53a Security fixes
1. Password reset tokens: use crypto/rand instead of math/rand
2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies
3. Cleanup: purge failed login attempts older than 24 hours
4. JWT secret: validate minimum 32 character length on startup

Updated .env.example with TRUSTED_PROXIES setting
2026-03-23 01:09:26 +01:00
..
aliases.go Switch from net/http to gin-gonic web framework 2026-03-22 23:28:28 +01:00
auth.go Security fixes 2026-03-23 01:09:26 +01:00
domains.go Add domain name validation 2026-03-22 23:52:37 +01:00
logs.go Switch from net/http to gin-gonic web framework 2026-03-22 23:28:28 +01:00
middleware.go Switch from net/http to gin-gonic web framework 2026-03-22 23:28:28 +01:00
queue.go Switch from net/http to gin-gonic web framework 2026-03-22 23:28:28 +01:00
response.go Switch from net/http to gin-gonic web framework 2026-03-22 23:28:28 +01:00
stats.go Switch from net/http to gin-gonic web framework 2026-03-22 23:28:28 +01:00
users.go Get real mailbox size from dovecot 2026-03-23 00:24:40 +01:00