fbbbb3b867
fix: comprehensive security improvements and UI fixes
...
- Remove overly restrictive password complexity requirements (now only 8+ chars)
- Fix Change Password section not appearing in Settings > Security
- Fix logout sometimes showing setup page instead of login page
- Remove misleading desktop notifications option from first-run setup
- Improve rate limiting on authentication endpoints
- Fix sensitive data appearing in logs (passwords, tokens)
- Enhance file permissions for sensitive files (0600)
- Fix WebSocket origin validation defaults
- Add password complexity validation for setup
- Improve CSRF token handling after server restarts
- Fix security status API using wrong fetch client
- Add logout race condition prevention
Security improvements:
- No credential leakage in logs
- Proper bcrypt password hashing
- Session management enhancements
- Rate limiting on all auth endpoints
- Secure file permissions on sensitive data
2025-08-16 21:10:24 +00:00
b316510a2b
fix: resolve WebSocket metric updates and improve polling efficiency
...
- Fix alternating zero I/O metrics by implementing rate caching for stale data from Proxmox
- Hardcode polling interval to 10 seconds (matching Proxmox cluster/resources update cycle)
- Remove polling interval settings from UI (no longer user-configurable)
- Implement efficient VM/container polling using single cluster/resources API call
- Remove 'Remove Password' feature (auth is now mandatory)
- Fix CSRF validation for Basic Auth (exempt from CSRF checks)
- Fix Generate API Token modal and authentication
- Remove redundant 'Active' status from Authentication section
- Remove Connection Timeout setting from frontend (backend-only)
- Clean up frontend console logging (reduce verbosity)
- Remove PBS polling interval setting (fixed at 10s)
- Add frontend rebuild detection to backend-watch script
- Improve first-run setup flow and error handling
2025-08-16 12:12:10 +00:00
0f36d1248d
feat: enhance security and improve login UI
...
Security Improvements:
- Implement bcrypt password hashing (cost factor 12)
- Add SHA3-256 API token hashing
- Fix authentication enforcement after security setup
- Improve restart mechanism to properly reload systemd environment
- Add CSRF protection for all state-changing operations
- Implement comprehensive rate limiting (10/min auth, 500/min API)
- Remove sensitive data from logs
- Add security audit test suite
UI Enhancements:
- Add Pulse logo to login screen with animations
- Implement glassmorphism design for login form
- Add gradient backgrounds and smooth animations
- Enhance input fields with icons
- Add loading spinner for authentication
- Improve overall login page aesthetics
Bug Fixes:
- Fix security setup restart mechanism
- Fix systemd environment variable inheritance
- Fix CSRF validation for security endpoints
- Fix password change and removal functionality
Testing:
- Add automated security test suite
- Verify all authentication flows
- Test rate limiting effectiveness
- Validate CSRF protection
2025-08-13 23:07:57 +00:00
565573ac40
feat: enhance security and improve API token UX
...
Security Improvements:
- Add comprehensive CSRF protection for state-changing operations
- Implement rate limiting (500 req/min general, 10/min for auth)
- Add account lockout after 5 failed login attempts
- Secure session management with HttpOnly cookies
- Add security headers (CSP, X-Frame-Options, etc.)
- Implement audit logging for security events
- Session invalidation on password change
API Token UX Improvements:
- Always show API token to authenticated users (no longer hide after generation)
- Add ability to view existing token anytime from Settings
- Fix clipboard copy with HTTP fallback
Authentication Flow Fixes:
- Fix WebSocket initialization to occur after auth check
- Fix CSRF validation to handle server restarts gracefully
- Adjust rate limiting to exclude high-frequency endpoints
- Fix authentication check to use session cookies properly
Documentation Updates:
- Document all security features comprehensively
- Update API documentation with CSRF usage examples
- Add security feature details to README
2025-08-13 19:05:23 +00:00
5e079db893
refactor: consolidate authentication system and improve API structure
...
- Remove registration tokens feature in favor of simpler API token auth
- Add password authentication with change password functionality
- Centralize API client logic with proper auth handling
- Add development scripts for better DX (hot-reload, proxy setup)
- Refactor auth middleware and handlers for cleaner separation
- Update frontend to use new centralized API client
2025-08-13 14:51:46 +00:00
decce4f39f
feat: implement secure registration token system with fixes
...
- Add registration token system for secure node auto-registration
- Implement token generation, validation, and revocation APIs
- Add frontend UI for managing registration tokens
- Fix polling interval hot-reload to work without restart
- Fix environment variable persistence for system settings
- Optimize monitor reload to avoid 'no nodes configured' message
- Fix goroutine leak in token manager cleanup
- Fix context propagation in reload logic
- Fix AUTO_UPDATE_ENABLED persistence bug
- Add proper error handling and security validation
- Ensure all resources properly cleaned up with defer statements
2025-08-09 11:54:26 +00:00
Pulse Monitor