4 Commits

Author	SHA1	Message	Date
hobokenchicken	d3b7f39b9e	fix(build): make build-web works; gofmt all Go files	2026-06-30 10:01:11 -04:00
hobokenchicken	a8a09cf7b4	fix: CSRF and WS origin check trust request Host header (same-origin)	2026-06-29 14:38:18 -04:00
hobokenchicken	5c7e461dad	fix: CSRF middleware now trusts origin hostname match instead of exact prefix ... The old CSRF middleware used exact string matching against a static list of origins (https://host, http://localhost:port). This broke when the frontend ran on a different port (Vite dev server) or accessed via LAN IP. New behavior: - Origin hostname matching: any Origin whose hostname matches cfg.Host is trusted, regardless of scheme or port - Localhost variants always trusted: localhost, 127.0.0.1, ::1 - Additional origins can be passed explicitly (future env var support)	2026-06-29 12:57:52 -04:00
hobokenchicken	130187c7be	security: remediate all P0-P2 audit findings (12 tasks) ... P0 fixes: - WebSocket origin checking (reject untrusted origins) - WS session token moved from URL query param to first message frame - WebAuthn login cookie now uses Secure flag via shared SetSessionCookie - PostgreSQL sslmode configurable via POSTGRES_SSLMODE env (default: require) - Fixed DatabaseDSN to use real password instead of masked placeholder P1 fixes: - Per-IP rate limiting middleware (auth: 5 req/s, invites: 2 req/s) - Security headers on all responses (CSP, X-Frame-Options, nosniff, etc.) - WS broadcasts scoped to server members (prevents cross-server data leak) - Webhook tokens stored as SHA-256 hashes (not plaintext) P2 fixes: - CSRF protection via Origin header validation on state-changing requests - MANAGE_CHANNELS permission enforced on channel update/delete - Upload validation: 25MB limit, extension allowlist, server-side MIME check - File serve: path traversal protection + Content-Disposition: attachment Files: 23 changed, +499/-100. Builds clean (go build, go vet, npm build). Zero CVEs (govulncheck, npm audit).	2026-06-29 09:30:50 -04:00