certctl

mirror of https://github.com/shankar0123/certctl.git synced 2026-06-07 14:51:30 +00:00

Files

T

shankar0123 7d2e7043b9 fix(server): SEC-003 — keep securityHeadersMiddleware in rate-limit stack

Sprint 1 unified-master-audit closure. cmd/server/main.go built two
middleware stacks: a default (line ~2054) and a rate-limit-enabled
rebuild (line ~2079). The rebuild dropped securityHeadersMiddleware,
silently turning off five browser-side defenses (Strict-Transport-
Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy,
Content-Security-Policy) the moment an operator flipped
CERTCTL_RATE_LIMIT_ENABLED=true.

Fix: re-insert securityHeadersMiddleware at the same position as the
default stack and place rateLimiter immediately after, so even a 429
response carries the same headers as a 200.

Regression coverage:
  - cmd/server/main_test.go TestMain_RateLimitedStack_EmitsSecurityHeaders
    mirrors the production stack composition and asserts each of the
    five headers lands on the response. A future regression that
    removes securityHeadersMiddleware (or reorders it after the rate
    limiter such that a 429 misses the headers) surfaces here.

Closes SEC-003.

2026-05-16 03:32:08 +00:00

auth_backfill_test.go

auth-bundle-1 Phase 0-5 closure: demo-mode wire, named-key backfill, AuthCheck enrichment, OpenAPI schema, intermediate-ca comment refresh

2026-05-09 19:33:07 +00:00

auth_backfill.go

legal: addlicense headers + normalize legacy variants (Phase 0 RED-4)

2026-05-13 21:23:35 +00:00

auth_exempt_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

finalhandler_test.go

M-001/M-006: strip HTTP auth from EST/SCEP + fail-loud SCEP preflight