GrottoCenter / grottocenter-api / 25964255883

87%

Build Type

push

github

Committed by ClemRz

Commit Message

fix(auth): harden password handling and add security headers

- Add HSTS, X-Content-Type-Options, X-Frame-Options security headers
- Add auth-specific rate limiting (10 req/15min) for login, signup,
  forgot-password, and change-password endpoints
- Add 1 KB body size limit on auth endpoints to prevent DoS via
  oversized payloads
- Reduce verbosity of authenticated user log (id, nickname, groups only)
- Add integration tests for security headers and auth body limit

Closes #1579

Coverage Stats

3197 of 3827 branches covered (83.54%)

Branch coverage included in aggregate %.

20 of 20 new or added lines in 2 files covered. (100.0%)

2 existing lines in 1 file now uncovered.

6501 of 7358 relevant lines covered (88.35%)

56.14 hits per line