 Knienartowicz
|
8da6f8c9fd
|
security: fix 3 critical + 3 high findings from production audit
Critical:
- C-01: WebSocket Origin validation (CSWSH protection) via new middleware/wsOrigin.js, applied to wsRelay, chatRelay, remoteRelay, bdRelay, cdapTerminalProxy, cdapMediaProxy
- C-02: Remove Tauri Origin-based CSRF bypass in server.js; only /api/bd/* skipped
- C-03: Update vulnerable deps (express 4.21.2, multer 2.0.0, protobufjs 7.4.0, helmet 7.2.0, axios 1.9.0, cookie-parser 1.4.7, express-session 1.18.1)
High:
- H-01: Disable auto-create-local-user on login by default; opt-in via BETTERDESK_AUTH_AUTOCREATE=true (does not affect ensureDefaultAdmin fresh-install bootstrap)
- H-02: Bearer-only auth for /api/bd/*; session cookie fallback removed; tokens redacted in logs
- H-05: Replace custom PBKDF2 with golang.org/x/crypto/pbkdf2; 600k iterations; new format pbkdf2-sha256\\\ with backward-compat for legacy salt:hash
Backward compatibility: legacy password hashes still verify; CSRF tokens still obtainable via csrfTokenProvider; fresh-install admin bootstrap (.admin_credentials flow) unchanged.
Audit report: docs/security/AUDIT_PRODUCTION_2026-04-10.md
This commit was made possible thanks to Insolve.
|
2026-05-26 13:35:12 +02:00 |
|