mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-09-21 01:53:33 +00:00
xarmian
30fe60d666
* feat: add session binding, nonce-based CSP, and auth hardening Security hardening for Pad Cloud (PLAN-15 / TASK-171): - Bind sessions to User-Agent hash; mismatch invalidates session - Store client IP on session creation for audit trail - Increase bcrypt cost from 10 to 12 - Upgrade invitation codes to 128-bit entropy with hashed storage - Replace CSP unsafe-inline with per-request nonce for SvelteKit scripts - Move SecurityHeaders to main router so SPA gets headers too * fix: enforce session binding on auth cookie fallbacks and fix invitation code uniqueness - Add validateSessionCookie() helper that checks UA binding, replacing raw ValidateSession() calls in handleSessionCheck, handleGetCurrentUser, and handleUpdateCurrentUser that bypassed the new session binding - Store invitation ID in code column instead of empty string to satisfy the NOT NULL UNIQUE constraint (previously broke on second invitation) - Skip code/join_url in invitation listings for hashed invitations where the plaintext is not recoverable
8 lines
432 B
SQL
8 lines
432 B
SQL
-- Session binding: store IP address and User-Agent hash for session theft detection
|
|
ALTER TABLE sessions ADD COLUMN ip_address TEXT DEFAULT '';
|
|
ALTER TABLE sessions ADD COLUMN ua_hash TEXT DEFAULT '';
|
|
|
|
-- Invitation code hardening: store hashed codes (128-bit entropy)
|
|
ALTER TABLE workspace_invitations ADD COLUMN code_hash TEXT DEFAULT '';
|
|
CREATE INDEX IF NOT EXISTS idx_invitations_code_hash ON workspace_invitations(code_hash);
|