certauth

jarianc/certauth

Fork 0

Commit Graph

Author	SHA1	Message	Date
Jarian Cottingham	df82068aeb	fix: CSRF protection, cookie security flags, rate limiting, XSS (#23,#24,#25,#28,#33) Add CSRF tokens to all cookie-based POST endpoints. Set Secure and SameSite=Strict on auth cookie. Rate limit login to 5 attempts per 15min per IP. Escape HTML in signing error messages (XSS fix). Remove duplicate get_user_from_cookie definition.	2026-07-04 04:51:56 +00:00
Jarian Cottingham	c759597ad0	fix: pass YubiKey PIN via stdin instead of CLI arg (#18 , #31 ) --pin-source stdin prevents PIN visibility in `ps` output. Use tempfile.mkstemp for all temp files (unpredictable names, 0600 perms). Clean up temp files in finally block. Add tests for PIN not in args and mkstemp usage.	2026-07-04 04:49:56 +00:00
Jarian Cottingham	279a28515f	fix: generate JWT secret on first boot instead of hardcoded default (#19 ) Generate random 256-bit secret stored in /var/lib/certauth/.jwt_secret (mode 0600) ENV JWT_SECRET takes precedence. Remove CHANGE_ME_JWT_SECRET default. Add tests for secret generation and env override	2026-07-04 04:48:30 +00:00

Author

SHA1

Message

Date

Jarian Cottingham

df82068aeb

fix: CSRF protection, cookie security flags, rate limiting, XSS (#23,#24,#25,#28,#33)

Add CSRF tokens to all cookie-based POST endpoints.
Set Secure and SameSite=Strict on auth cookie.
Rate limit login to 5 attempts per 15min per IP.
Escape HTML in signing error messages (XSS fix).
Remove duplicate get_user_from_cookie definition.

2026-07-04 04:51:56 +00:00

Jarian Cottingham

c759597ad0

fix: pass YubiKey PIN via stdin instead of CLI arg (#18 , #31 )

--pin-source stdin prevents PIN visibility in `ps` output.
Use tempfile.mkstemp for all temp files (unpredictable names, 0600 perms).
Clean up temp files in finally block.
Add tests for PIN not in args and mkstemp usage.

2026-07-04 04:49:56 +00:00

Jarian Cottingham

279a28515f

fix: generate JWT secret on first boot instead of hardcoded default (#19 )

Generate random 256-bit secret stored in /var/lib/certauth/.jwt_secret (mode 0600)
ENV JWT_SECRET takes precedence. Remove CHANGE_ME_JWT_SECRET default.
Add tests for secret generation and env override

2026-07-04 04:48:30 +00:00

3 Commits